topic Where does rest/services/apps/local get data? in Splunk Dev

Where does rest/services/apps/local get data?

joshuapetitt — Tue, 13 Mar 2018 18:01:43 GMT

I'm trying to get a list of installed addons for both local server instances and for deployed addons.

I've tried using the search:

| rest /services/apps/local

however, I am wondering where this data is coming from? For instance, I had an app in opt/splunk/etc/apps, but I have since deleted that specific app folder. However it still shows in the list?

Also, I have apps which I installed via the interface, but have then moved to deployment-apps (they are meant to be deployment apps). They show in the search results, but I'm wondering why? Should they?

Re: Where does rest/services/apps/local get data?

somesoni2 — Tue, 13 Mar 2018 18:14:10 GMT

Data for those rest api endpoint is stored in memory and is updated when Splunk restarts/refreshes/reloaded. You must not have restarted Splunk after you deleted that app, hence the data for /services/apps/local is not updated. Just get Splunk restarted and try again.

Re: Where does rest/services/apps/local get data?

joshuapetitt — Tue, 13 Mar 2018 18:22:54 GMT

@somesoni2, thank you! That fixed the issue, and makes sense now. If you make this an answer, I'll accept.