topic How do you detect a Universal Forwarder (UF) vs Enterprise from CLI? in Getting Data In

How do you detect a Universal Forwarder (UF) vs Enterprise from CLI?

satyenshah — Thu, 01 Nov 2018 19:56:49 GMT

On Linux, what is the "official" way of detecting whether a host has full Splunk Enterprise versus the Universal Forwarder installed/running?

For both packages, the file "etc/splunk.version" is identical. Also "bin/splunk version" returns the same output when run from either package.

$SPLUNK_HOME tends to differ between Splunk and the Splunk forwarder, but that is not a always predictable. The .manifest file tends to have a different prefix. And there are several subfolders that exist in the Enterprise package that don't exist in the UF package. I can trigger off those differences, but that seems indirect. I would rather the Splunk instance have an official and definitive way of telling me "I am a UF" or "I am Splunk Enterprise"

What is the best way of doing that?

Re: How do you detect a Universal Forwarder (UF) vs Enterprise from CLI?

preotesoiu — Thu, 01 Nov 2018 20:56:11 GMT

Hello,

Splunk Enterprise is installed in a folder called "splunk" while Splunk universal forwarder is installed into a folder called "splunkforwarder".

Also running "splunk version" command should return the correct response. In my case, this is the response I get when running "version" command:
$ /opt/splunkforwarder/bin/splunk version
Splunk Universal Forwarder 7.1.4 (build 5a7a840afcb3)

hope it helps

Re: How do you detect a Universal Forwarder (UF) vs Enterprise from CLI?

satyenshah — Thu, 01 Nov 2018 21:22:01 GMT

Thanks! I was inadvertently executing the wrong binary.