I know that you can run splunk version to get an output telling you whether a Splunk install has the UF binaries or the full binaries, but is there ever anything logged? I did a search of my $SPLUNK_HOME/var/log/splunk and didn't find the word "universal" anywhere.
Try this search:
index=_internal fwdtype sourcetype=splunkd component=Metrics | table host fwdType | dedup host
I've never run that search before today, but it appears based on our systems to log "uf" for Universal Forwarders and "full" for a Splunk Enterprise install.
Hope that helps.
Try this search:
index=_internal fwdtype sourcetype=splunkd component=Metrics | table host fwdType | dedup host
I've never run that search before today, but it appears based on our systems to log "uf" for Universal Forwarders and "full" for a Splunk Enterprise install.
Hope that helps.