@sabdulkader,
As far as I know, there is no direct command in splunk to achieve this. However, if you can onboard the application log into splunk then you should be able to search for specific event ids.
for example: I know that in windows application log, event id: 11707 (or 1033) would show the details about the software installed. Similarly, 11724 (or 1034) will also show the software uninstalled.
I am not sure about any such direct way in Unix. Maybe you can create a shell script that will pull the user's history and stream into splunk. Then all you will have to do is to search certain keywords like install, uninstall, remove etc..
Does it help?
