Getting Data In

Is there a way to determine if a Linux Splunk Forwarder has accepted the license after it's been installed?

jmaple
Communicator

Is there a way yo determine if the license has been accepted on a fresh installation or upgrade of a universal forwarder on a *nix machine? A file/line in a file that aren't present until after the license is accetped? I'm using BigFix to deploy the 6.2.3 upgrade in our environment and don't have access to the *nix machines and need to confirm that the task completes.

1 Solution

acharlieh
Influencer

Quickly installing the UF on a VM, and doing a recursive LS on the contents, accepting the license, and doing the same, it looks like the best thing to check would be the existence of the $SPLUNK_HOME/ftr file. If that exists then the license has NOT yet been accepted. There are a number of other changes on first run, but in an upgrade scenario I would think the majority of these should already exist.

View solution in original post

acharlieh
Influencer

Quickly installing the UF on a VM, and doing a recursive LS on the contents, accepting the license, and doing the same, it looks like the best thing to check would be the existence of the $SPLUNK_HOME/ftr file. If that exists then the license has NOT yet been accepted. There are a number of other changes on first run, but in an upgrade scenario I would think the majority of these should already exist.

jmaple
Communicator

Looks like that's exactly what I was looking for. Much appreciated.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...