topic Re: Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146261#M29783 <P>If anyone wants to do this, feel free to download the App TA-forwarderquery<BR /> <A href="https://splunkbase.splunk.com/app/2775/">https://splunkbase.splunk.com/app/2775/</A></P> Mon, 22 Jun 2015 08:57:05 GMT dominiquevocat 2015-06-22T08:57:05Z Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder? https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146259#M29781 <P>There is a endpoint on a forwarder which lists the monitors i.e. the files indexed<BR /> <CODE>/servicesNS/nobody/_appname_/data/inputs/monitor/</CODE><BR /> however, this endpoint lists all files monitored and not only the ones by this app.</P> <P>How can i get the files monitored by an app or the files only in the "search" app i.E. manually added by an administrator on the machine?</P> Fri, 17 Apr 2015 07:56:35 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146259#M29781 dominiquevocat 2015-04-17T07:56:35Z Re: Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder? https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146260#M29782 <P>One workarround is to filter by the desired string in the feed.entry.id</P> <PRE><CODE>| rename feed.entry.id AS id | rename feed.entry.title AS title | eval tmp=mvzip(title,id) | table tmp | mvexpand tmp | eval tmp=split(tmp,",")| eval file=mvindex(tmp,0) | eval id=mvindex(tmp,1) | search id="*myAppName*" | table file </CODE></PRE> <P>Not so very nice but somewhat ok-ish</P> Fri, 17 Apr 2015 11:53:22 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146260#M29782 dominiquevocat 2015-04-17T11:53:22Z Re: Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder? https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146261#M29783 <P>If anyone wants to do this, feel free to download the App TA-forwarderquery<BR /> <A href="https://splunkbase.splunk.com/app/2775/">https://splunkbase.splunk.com/app/2775/</A></P> Mon, 22 Jun 2015 08:57:05 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146261#M29783 dominiquevocat 2015-06-22T08:57:05Z Re: Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder? https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146262#M29784 <P>This is awesome. This should be built-in!</P> Wed, 24 Jun 2015 08:20:36 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146262#M29784 ncsantucci 2015-06-24T08:20:36Z Re: Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder? https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146263#M29785 <P>glad you like it. open for suggestions @ncsantucci</P> Fri, 25 Nov 2016 16:13:11 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-REST-API-How-can-I-get-the-list-of-files-monitored-by/m-p/146263#M29785 dominiquevocat 2016-11-25T16:13:11Z