On Linux, what is the "official" way of detecting whether a host has full Splunk Enterprise versus the Universal Forwarder installed/running?
For both packages, the file "etc/splunk.version" is identical. Also "bin/splunk version" returns the same output when run from either package.
$SPLUNK_HOME tends to differ between Splunk and the Splunk forwarder, but that is not a always predictable. The .manifest file tends to have a different prefix. And there are several subfolders that exist in the Enterprise package that don't exist in the UF package. I can trigger off those differences, but that seems indirect. I would rather the Splunk instance have an official and definitive way of telling me "I am a UF" or "I am Splunk Enterprise"
What is the best way of doing that?
Hello,
Splunk Enterprise is installed in a folder called "splunk" while Splunk universal forwarder is installed into a folder called "splunkforwarder".
Also running "splunk version" command should return the correct response. In my case, this is the response I get when running "version" command:
$ /opt/splunkforwarder/bin/splunk version
Splunk Universal Forwarder 7.1.4 (build 5a7a840afcb3)
hope it helps
Hello,
Splunk Enterprise is installed in a folder called "splunk" while Splunk universal forwarder is installed into a folder called "splunkforwarder".
Also running "splunk version" command should return the correct response. In my case, this is the response I get when running "version" command:
$ /opt/splunkforwarder/bin/splunk version
Splunk Universal Forwarder 7.1.4 (build 5a7a840afcb3)
hope it helps
Thanks! I was inadvertently executing the wrong binary.