Splunk is getting lots of notifications after upgrading Universal Forwarder

Applicability

Description

The following service bulletin is sent to Splunk Cloud environments regarding downloading the new forwarder package.

"Recently completed maintenance on the Splunk Cloud Platform stack and have updated the universal forwarder app & associated certificate package. Download the new forwarder package with the updated certificate and install it on all forwarders. The package can be found on Splunk main page after logging in, under the Universal Forwarder App"

Investigation

Run the below search to validate if the forwarder was upgraded or not to the latest version.

index=_internal source=*metrics.log group=tcpout_connections name=splunkcloud*
| stats latest(_time) AS _time latest(name) AS name by host
| rex field=name "(?<output_group>.+?)\:"
| eval fwd_config=if(output_group="splunkcloud","legacy","new")
| stats count by _time host output_group fwd_config
| reltime
| fields _time reltime host output_group fwd_config
| sort 0 fwd_config

Resolution

Run the search below in the stack to determine that the forwarders were upgraded and the notifications are for the informational purposes.

index=_internal source=*metrics.log group=tcpout_connections name=splunkcloud*
| stats latest(_time) AS _time latest(name) AS name by host
| rex field=name "(?<output_group>.+?)\:"
| eval fwd_config=if(output_group="splunkcloud","legacy","new")
| stats count by _time host output_group fwd_config
| reltime
| fields _time reltime host output_group fwd_config
| sort 0 fwd_config