What is the easiest way to identify my universal forwarder versions

[conner9]

I'm looking for a search that will let me check what forwarder revisions are installed on individual machines.

Anyone know of one?

Thanks,

[kscher · Accepted solution]

I lifted this from somewhere - might have been SoS. It's got cosmetics you probably don't need and it returns data for all types of forwarders, not just UFs. Anyhow, here it is:

index="_internal" source="*metrics.lo*" group=tcpin_connections | dedup guid| eval sourceHost=if(isnull(hostname), sourceHost,hostname) | eval connectionType=case(fwdType=="uf","universal forwarder", fwdType=="lwf", "lightweight forwarder",fwdType=="full", "heavy forwarder", connectionType=="cooked" or connectionType=="cookedSSL","Splunk forwarder", connectionType=="raw" or connectionType=="rawSSL","legacy forwarder")| eval build=if(isnull(build),"n/a",build) | eval version=if(isnull(version),"pre 4.2",version) | eval guid=if(isnull(guid),sourceHost,guid) | eval os=if(isnull(os),"n/a",os)| eval arch=if(isnull(arch),"n/a",arch) | table sourceHost connectionType sourceIp sourceHost ssl ack build version os arch guid

[murphy2400]

Thanks. Needed a quick search and this still works in 8.0.1

[conner9]

This was exactly what I was looking for.

Thank you

[dshpritz]

I think this is from Deployment Monitor

[martin_mueller]

The easiest way would be to install the SoS app: http://apps.splunk.com/app/748/
That already comes with searches to pry the info from Splunk's logs.