How do you detect a Universal Forwarder (UF) vs Enterprise from CLI?

[satyenshah]

On Linux, what is the "official" way of detecting whether a host has full Splunk Enterprise versus the Universal Forwarder installed/running?

For both packages, the file "etc/splunk.version" is identical. Also "bin/splunk version" returns the same output when run from either package.

$SPLUNK_HOME tends to differ between Splunk and the Splunk forwarder, but that is not a always predictable. The .manifest file tends to have a different prefix. And there are several subfolders that exist in the Enterprise package that don't exist in the UF package. I can trigger off those differences, but that seems indirect. I would rather the Splunk instance have an official and definitive way of telling me "I am a UF" or "I am Splunk Enterprise"

What is the best way of doing that?

[preotesoiu · Accepted solution]

Hello,

Splunk Enterprise is installed in a folder called "splunk" while Splunk universal forwarder is installed into a folder called "splunkforwarder".

Also running "splunk version" command should return the correct response. In my case, this is the response I get when running "version" command:
$ /opt/splunkforwarder/bin/splunk version
Splunk Universal Forwarder 7.1.4 (build 5a7a840afcb3)

hope it helps

[satyenshah]

Thanks! I was inadvertently executing the wrong binary.