Determine which version of Splunk you're running
Determine which version of Splunk you're running
In Splunk Web
Every page title in Splunk Web includes the version and build numbers. You can also click on the About link at the top right of most pages to view a JavaScript overlay with the version and build numbers.
At the command line
Use one minus or two minuses; Splunk gets it either way:
> ./splunk --version Splunk 4.2.3 (build 105368)
or
> ./splunk -version Splunk 4.2.3 (build 105368)
From the files
You can get the version information from the file $SPLUNK_HOME/etc/splunk.version
> cat $SPLUNK_HOME/etc/splunk.version VERSION=4.2.3 BUILD=105368 PRODUCT=splunk PLATFORM=Darwin-universal
In Splunk Search
Starting with version 4.0.10, Splunk indexes the splunk.version file into the _internal index and sends it along to the indexer by forwarders.
Here's a search that shows you how many installs you have of each Splunk version:
index=_internal sourcetype=splunk_version | dedup host | top VERSION
This documentation applies to the following versions of Splunk: 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 View the Article History for its revisions.