Getting Data In

What is the easiest way to identify my universal forwarder versions

conner9
Path Finder

I'm looking for a search that will let me check what forwarder revisions are installed on individual machines.

Anyone know of one?

Thanks,

1 Solution

kscher
Path Finder

I lifted this from somewhere - might have been SoS. It's got cosmetics you probably don't need and it returns data for all types of forwarders, not just UFs. Anyhow, here it is:

index="_internal" source="*metrics.lo*" group=tcpin_connections | dedup guid| eval sourceHost=if(isnull(hostname), sourceHost,hostname) | eval connectionType=case(fwdType=="uf","universal forwarder", fwdType=="lwf", "lightweight forwarder",fwdType=="full", "heavy forwarder", connectionType=="cooked" or connectionType=="cookedSSL","Splunk forwarder", connectionType=="raw" or connectionType=="rawSSL","legacy forwarder")| eval build=if(isnull(build),"n/a",build) | eval version=if(isnull(version),"pre 4.2",version) | eval guid=if(isnull(guid),sourceHost,guid) | eval os=if(isnull(os),"n/a",os)| eval arch=if(isnull(arch),"n/a",arch) | table sourceHost connectionType sourceIp sourceHost ssl ack build version os arch guid

View solution in original post

kscher
Path Finder

I lifted this from somewhere - might have been SoS. It's got cosmetics you probably don't need and it returns data for all types of forwarders, not just UFs. Anyhow, here it is:

index="_internal" source="*metrics.lo*" group=tcpin_connections | dedup guid| eval sourceHost=if(isnull(hostname), sourceHost,hostname) | eval connectionType=case(fwdType=="uf","universal forwarder", fwdType=="lwf", "lightweight forwarder",fwdType=="full", "heavy forwarder", connectionType=="cooked" or connectionType=="cookedSSL","Splunk forwarder", connectionType=="raw" or connectionType=="rawSSL","legacy forwarder")| eval build=if(isnull(build),"n/a",build) | eval version=if(isnull(version),"pre 4.2",version) | eval guid=if(isnull(guid),sourceHost,guid) | eval os=if(isnull(os),"n/a",os)| eval arch=if(isnull(arch),"n/a",arch) | table sourceHost connectionType sourceIp sourceHost ssl ack build version os arch guid

murphy2400
New Member

Thanks. Needed a quick search and this still works in 8.0.1

0 Karma

conner9
Path Finder

This was exactly what I was looking for.

Thank you

dshpritz
SplunkTrust
SplunkTrust

I think this is from Deployment Monitor

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The easiest way would be to install the SoS app: http://apps.splunk.com/app/748/
That already comes with searches to pry the info from Splunk's logs.

Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...