Refine your search:

4
1

Is there a search that I can run at the indexer that will tell me what versions my forwarders are on?

asked 04 Feb '10, 19:01

the_wolverine's gravatar image

the_wolverine ♦
4.3k5843
accept rate: 50%


2 Answers:

The capability was added in 4.0.10 (forwarders) to forward on the license.version file. As a workaround for pre-4.0.10 forwarders, you can configure the following input on your forwarder's inputs.conf:

[monitor://$SPLUNK_HOME/etc/splunk.version]
index = _internal
host=myLWF1
sourcetype=splunk_version
_TCP_ROUTING = *

This will forward the splunk.version file to your indexer. You can then easily figure out what version each forwarder host is running by searching on the LWF hostname and sourcetype=splunk_version.

link

answered 02 Apr '10, 05:27

the_wolverine's gravatar image

the_wolverine ♦
4.3k5843
accept rate: 50%

edited 03 Apr '10, 15:55

This is in 4.0.10. release, so if you are there, you don't need to add it.

(02 Apr '10, 14:27) gkanapathy ♦

No, but there are plans to do this in a future version

link

answered 05 Feb '10, 22:36

Mick's gravatar image

Mick ♦
4.0k1327
accept rate: 52%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×1,089
×403
×19

Asked: 04 Feb '10, 19:01

Seen: 687 times

Last updated: 03 Apr '10, 15:55

Copyright © 2005-2012 Splunk, Inc. All rights reserved.