On Linux, what is the "official" way of detecting whether a host has full Splunk Enterprise, versus the Universal Forwarder installed/running?
For both packages, the file "etc/splunk.version" is identical. Also "bin/splunk version" returns the same output when run from either package.
$SPLUNK_HOME tends to differ between Splunk and the Splunk forwarder, but that is not a always predictable. The .manifest file tends to have a different prefix. And there are several subfolders that exist in the Enterprise package that don't exist in the UF package. I can trigger off those differences, but that seems indirect. I would rather the Splunk instance have an official and definitive way of telling me "I am a UF" or "I am Splunk Enterprise"
What is the best way of doing that?
↧