How to identify Lightweight Forwarders vs Universal Forwarders from Deployment Server?

Question

I'm dealing with an environment of mixed Lightweight Forwarders and Universal Forwarders. How can I tell, without logging into the forwarders, which is running what?

The build number for LWF/main package of Splunk is confusingly identical to that of the UF.

Accepted Answer

1

Try this:

index=_internal source=*metrics.log group=tcpin_connections | dedup sourceHost, sourceIp | table sourceHost, sourceIp, ssl, lastIndexer, fwdType

link

answered 07 Jun '11, 13:33

mw
1.6k●12
accept rate: 30%

Great. This also works in 4.2, and contains hostnames instead of IPs (in our environment at least): index=_internal source=fwd | dedup hostname | table hostname, ssl, lastIndexer, fwdType

(09 Jun '11, 06:16) Jason

How to identify Lightweight Forwarders vs Universal Forwarders from Deployment Server?

Follow this question

Splunk Resources

Related questions