Made minor updates of the answer to show forwarder types for all clients and make a table:
index=_internal source=metrics.log group=tcpin_connections fwdType= | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | eval connectionType=case(fwdType=="univ*","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectionType=="cooked" or connectionType=="cookedSSL","Splunk fwder", connectionType=="raw" or connectionType=="rawSSL","legacy fwder") | eval version=if(isnull(version),"pre 4.2",version) | rename arch as MachineType | dedup sourceIp | table connectionType,sourceIp,sourceHost,version,MachineType
... View more