Getting Data In

Is there a way to determine if a Linux Splunk Forwarder has accepted the license after it's been installed?

jmaple
Communicator

Is there a way yo determine if the license has been accepted on a fresh installation or upgrade of a universal forwarder on a *nix machine? A file/line in a file that aren't present until after the license is accetped? I'm using BigFix to deploy the 6.2.3 upgrade in our environment and don't have access to the *nix machines and need to confirm that the task completes.

1 Solution

acharlieh
Influencer

Quickly installing the UF on a VM, and doing a recursive LS on the contents, accepting the license, and doing the same, it looks like the best thing to check would be the existence of the $SPLUNK_HOME/ftr file. If that exists then the license has NOT yet been accepted. There are a number of other changes on first run, but in an upgrade scenario I would think the majority of these should already exist.

View solution in original post

acharlieh
Influencer

Quickly installing the UF on a VM, and doing a recursive LS on the contents, accepting the license, and doing the same, it looks like the best thing to check would be the existence of the $SPLUNK_HOME/ftr file. If that exists then the license has NOT yet been accepted. There are a number of other changes on first run, but in an upgrade scenario I would think the majority of these should already exist.

jmaple
Communicator

Looks like that's exactly what I was looking for. Much appreciated.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...