https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/322092#M60038 <P>I have looked into that REST API. I am trying out Splunk now so I am not sure whether some of the roles are associated with licenses or not. For now, my splunk enterprise installs have ["license_master","indexer"] roles and my universal forwarder has ["universal_forwarder","license_master"] roles. I cannot see "heavyweight_forwarder" in the roles endpoint although I have configured one enterprise instance to forward data. Is it related to licensing or do I need to use a deployment server to assign roles (and can it even be done with trial license)?</P> Tue, 29 Sep 2020 15:02:26 GMT anton085 2020-09-29T15:02:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/322090#M60036 <P>Hi,</P> <P>I am new to Splunk. I want to know if I can tell the differences of roles of Splunk servers using the REST API. For example, is it possible to know if a Splunk server is a heavy forwarder or a universal forwarder, or an indexer?</P> <P>Thanks.</P> Fri, 21 Jul 2017 14:57:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/322090#M60036 anton085 2017-07-21T14:57:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/322091#M60037 <P>See this</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.6/RESTREF/RESTsystem#server.2Froles">http://docs.splunk.com/Documentation/Splunk/6.2.6/RESTREF/RESTsystem#server.2Froles</A></P> Fri, 21 Jul 2017 17:22:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/322091#M60037 somesoni2 2017-07-21T17:22:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/322092#M60038 <P>I have looked into that REST API. I am trying out Splunk now so I am not sure whether some of the roles are associated with licenses or not. For now, my splunk enterprise installs have ["license_master","indexer"] roles and my universal forwarder has ["universal_forwarder","license_master"] roles. I cannot see "heavyweight_forwarder" in the roles endpoint although I have configured one enterprise instance to forward data. Is it related to licensing or do I need to use a deployment server to assign roles (and can it even be done with trial license)?</P> Tue, 29 Sep 2020 15:02:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/322092#M60038 anton085 2020-09-29T15:02:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/322093#M60039 <P>You can tell if it is a UF because that has a particular package that is different than the full enterprise package. The other roles are determined by how you configure it. For example, for a non-UF server, if it has a <CODE>serverclass.conf</CODE> file (which you can check with the REST API), then it is a DS. If it has an <CODE>outputs.conf</CODE> file, then it is a HF. If it has a <CODE>distserach.conf</CODE> file, then it is a Search Head (which covers MC, LC, DS, so this does not tell anything other than it is not an Indexer or UF).</P> Sun, 23 Jul 2017 01:37:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/322093#M60039 woodcock 2017-07-23T01:37:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/610833#M105830 <P>I know this is an old post but every Splunk enterprise server in a distributed deployment, except indexers, should have outputs.conf to forward its internal logs to the indexer(s). Also, the MC doesn't have a HF role designated, so I assume you aren't referring to MC roles here, just a function that server is performing. Is that right?</P> Thu, 25 Aug 2022 15:22:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-check-server-roles-via-the-rest-api/m-p/610833#M105830 tpickle 2022-08-25T15:22:05Z