We inherited Splunk from another team and my leadership wants to know if when Splunk was installed, if we opted out of sending information to Splunk. Is there a way to find out what the original installer selected for this option? I have not installed splunk so I am unsure if it even asks you if you want to opt out of sending splunk information to them.
I found this in the docs for 7.1.1:
The instrumentation feature adds an
internal index and can increase disk
space usage (Originally introduced in
The instrumentation feature of Splunk
Enterprise, which lets you share
Splunk Enterprise performance
statistics with Splunk after you opt
in, includes a new internal index
which can cause disk space usage to
rise on hosts that you upgrade. You
can opt out of sharing performance
data by following the instructions at
Share data in Splunk Enterprise in the
It appears that if you opt-in, since version 7.0, you will send license usage data by default.
Go to settings - > instrumentation
Click on the settings icon next to usage data to see what is turned on.
Documentation says "For the usage data logs to be created and available, your search heads, indexers, and cluster master must be running Splunk Enterprise version 6.5.0 or later."
So it might be a case that there is no collection prior to 6.5. I could be wrong.