Splunk Search

What forwarder versions am I running?

the_wolverine
Champion

Is there a search that I can run at the indexer that will tell me what versions my forwarders are on?

Tags (3)
1 Solution

the_wolverine
Champion

The capability was added in 4.0.10 (forwarders) to forward on the license.version file. As a workaround for pre-4.0.10 forwarders, you can configure the following input on your forwarder's inputs.conf:

[monitor://$SPLUNK_HOME/etc/splunk.version]
index = _internal
host=myLWF1
sourcetype=splunk_version
_TCP_ROUTING = *

This will forward the splunk.version file to your indexer. You can then easily figure out what version each forwarder host is running by searching on the LWF hostname and sourcetype=splunk_version.

View solution in original post

the_wolverine
Champion

The capability was added in 4.0.10 (forwarders) to forward on the license.version file. As a workaround for pre-4.0.10 forwarders, you can configure the following input on your forwarder's inputs.conf:

[monitor://$SPLUNK_HOME/etc/splunk.version]
index = _internal
host=myLWF1
sourcetype=splunk_version
_TCP_ROUTING = *

This will forward the splunk.version file to your indexer. You can then easily figure out what version each forwarder host is running by searching on the LWF hostname and sourcetype=splunk_version.

gkanapathy
Splunk Employee
Splunk Employee

This is in 4.0.10. release, so if you are there, you don't need to add it.

0 Karma

Mick
Splunk Employee
Splunk Employee

No, but there are plans to do this in a future version

ben_leung
Builder

Hello from the future/present.....past....

Is there now a splunk query to run at the indexer level to display forwarder versions?

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...