topic Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder? in Getting Data In

Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

kennybirdwell — Thu, 14 Jul 2016 18:58:07 GMT

Through Forwarder Management, you can see Clients and list how many apps are installed on that client. What I want to be able to do is list the apps that are installed on a client, so if a client has three apps, how can I see what three apps are installed?

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

somesoni2 — Thu, 14 Jul 2016 20:19:54 GMT

Run this query from your deployment server instance
Updated - fixed typo

| rest /services/deployment/server/clients splunk_server=local| table hostname applications*.stateOnClient | untable hostname applications value | eval applications=replace(applications,"applications\.(\w+)\.stateOnClient","\1") | stats values(applications) as applications by hostname

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

a212830 — Thu, 14 Jul 2016 20:43:46 GMT

What does untable do? that's a new one...

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

somesoni2 — Thu, 14 Jul 2016 20:56:16 GMT

It converts table like

X Y1 Y2 Y3...
------------------
X1  v1 v2 v3

X  Y value
v1 Y1 v1
v1 Y2 v2
v1 Y3 v3

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

sloshburch — Fri, 15 Jul 2016 12:57:57 GMT

Check out untable and xyseries. They are each other's yin and yang. Think about how timechart throws a column for each value of a field - doing or undoing stuff like that is where those two commands play.

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

kennybirdwell — Fri, 15 Jul 2016 14:11:50 GMT

Thanks, that's exactly what I was looking for.

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

ashabc — Fri, 16 Jun 2017 03:17:51 GMT

How can I further filter it for a specific host or a specific app?

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

sloshburch — Fri, 16 Jun 2017 12:28:32 GMT

Use the SPL commands 'search' or 'where' to filter your result set. Remember that the earlier you filter, the better the performance you'll get.

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

ashabc — Mon, 19 Jun 2017 00:40:13 GMT

Thank you @SloshBurch. Splunk should provide this functionality in the Forwarder management GUI.

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

sogeniusio — Thu, 15 Feb 2018 17:02:17 GMT

Your regex should read

"applications\.(\w+)\.stateOnClient","\1"

Missing an "s"

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

somesoni2 — Thu, 15 Feb 2018 17:32:37 GMT

Good catch. Rectified now.

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

maurelio79 — Thu, 08 Aug 2019 08:21:24 GMT

In our case this show app installed on Heavy Forwarder not Universal Forwarder.
Is there a way to list installed apps on Universal Forwarder if in the middle there also Heavy Forwarder?

Thanks and regards

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

soofz — Fri, 20 Dec 2019 06:08:44 GMT

Is there a way to further get the versions for each app as well?

Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?

thambisetty — Tue, 22 Jun 2021 05:34:49 GMT

small correction:

if the application contains -(hyphen) then the regex from your search is not matching. for example application

applications.Splunk_TA_bit9-carbonblack.stateOnClient

I would suggest using below regex that will capture first . (period) to next .(period)

applications\.(.*)\.stateOnClient