I see you can enable/disable a light forwarder via the gui or cli, but can't seem to dig up the conf file that contains this. Is it possible to push a conf file change and restart splunk to accomplish this?
Thanks,
Scott
Hmm...appears it may be these two files:
$splunk_home/etc/apps/SplunkForwarder/default/app.conf:
[default]
[install]
state = disabled
$splunk_home/etc/apps/SplunkLightForwarder/local/app.conf:
[install]
state = enabled