Determine Universal Forwarder vs Other Forwarder from Logs

[David]

I know that you can run splunk version to get an output telling you whether a Splunk install has the UF binaries or the full binaries, but is there ever anything logged? I did a search of my $SPLUNK_HOME/var/log/splunk and didn't find the word "universal" anywhere.

[mcmaster · Accepted solution]

Try this search:

index=_internal fwdtype sourcetype=splunkd component=Metrics | table host fwdType | dedup host

I've never run that search before today, but it appears based on our systems to log "uf" for Universal Forwarders and "full" for a Splunk Enterprise install.

Hope that helps.