Does anyone have a good search to help track and report the weekly upgrade progress for universal forwarder agents?

[ltrand]

I was wondering if anyone has a good search that can help track the weekly upgrade progress for UF agents? With the deployment server I can see the topology & it reports the UF version, but it doesn't group them in any meaningful way. If I could create lists of hosts per UF version it would be helpful in working with all the groups that I have to interact with to get the environment on a single agent version.

My thought is I could run the report once a week and then diff the current to the previous report to easily get the changes.

Thanks!

[jeremiahc4 · Accepted solution]

See my answer on this question for an _internal search which should help you get going with it.

http://answers.splunk.com/answers/173520/what-search-query-can-i-use-on-my-search-head-to-l.html#ans...