Enable light forwarder via configuration file

[skippylou]

I see you can enable/disable a light forwarder via the gui or cli, but can't seem to dig up the conf file that contains this. Is it possible to push a conf file change and restart splunk to accomplish this?

Thanks,

Scott

[skippylou]

Hmm...appears it may be these two files:

$splunk_home/etc/apps/SplunkForwarder/default/app.conf:

[default]

[install]

state = disabled

$splunk_home/etc/apps/SplunkLightForwarder/local/app.conf:

[install]

state = enabled