topic Re: Improve query to list apps and versions on all indexer nodes in Splunk Search

Improve query to list apps and versions on all indexer nodes

radam2000 — Wed, 08 Apr 2020 20:39:41 GMT

I have this query to list the apps and their versions last update date for apps on all index nodes, however the updated date lists a default for all apps as "1969-12-31T19:00:00-05:00". Anyway to modify this to produce the proper updated date?

| rest /services/apps/local | search disabled=* |table splunk_server, title, label, version, updated, disabled, visible, description, author, configured, core, "eai:acl.app", "eai:acl.sharing", id

thanks in advance for any assistance...

Rich

Re: Improve query to list apps and versions on all indexer nodes

DalJeanis — Fri, 10 Apr 2020 23:49:55 GMT

Does it list the correct updated date/time for apps that are not disabled?

Re: Improve query to list apps and versions on all indexer nodes

radam2000 — Sat, 11 Apr 2020 15:35:00 GMT

It does not provide a correct update date for any entry - note output of query does show disabled field which contains both entries with 0 and 1 for true and false annd update date is the same

Thanks for your reply
Rich