Getting Data In

Is there a way to determine if a Linux Splunk Forwarder has accepted the license after it's been installed?

jmaple
Communicator

Is there a way yo determine if the license has been accepted on a fresh installation or upgrade of a universal forwarder on a *nix machine? A file/line in a file that aren't present until after the license is accetped? I'm using BigFix to deploy the 6.2.3 upgrade in our environment and don't have access to the *nix machines and need to confirm that the task completes.

1 Solution

acharlieh
Influencer

Quickly installing the UF on a VM, and doing a recursive LS on the contents, accepting the license, and doing the same, it looks like the best thing to check would be the existence of the $SPLUNK_HOME/ftr file. If that exists then the license has NOT yet been accepted. There are a number of other changes on first run, but in an upgrade scenario I would think the majority of these should already exist.

View solution in original post

acharlieh
Influencer

Quickly installing the UF on a VM, and doing a recursive LS on the contents, accepting the license, and doing the same, it looks like the best thing to check would be the existence of the $SPLUNK_HOME/ftr file. If that exists then the license has NOT yet been accepted. There are a number of other changes on first run, but in an upgrade scenario I would think the majority of these should already exist.

jmaple
Communicator

Looks like that's exactly what I was looking for. Much appreciated.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...