How to find first connect time/version of a universal Forwarder?

[att35]

Hi,

I am looking for a way to track when a new Splunk Forwarder connects along with the version. Was hoping to find some relevant field on Deployment Server (/services/deployment/server/clients) but I could only see lastPhoneHomeTime, nothing for when it first connected to the system.

Is it possible to get this information, either from Deployment Server or Forwarder's internal logs?

Thanks,

~ Abhi

[PickleRick]

Even if (I suppose the info must be there since the DS shows it - it searches the _internal index) you do that, remember that you're limited by _internal index's retention period.