Count of Apps

[sheltomt]

Upper management would like a count of all apps installed on our main Search Head. They want a "how many right now" to compare against in the future. My idea is to just make a then/now type report, haven't decided on visualization.

I'm not finding anything on Google that would allow me to count apps on demand.

Has anyone done this?

[lguinn2]

Well - one of the problems is this: do you want to count disabled apps? Do you want to count the built-in apps? Do add-ons count?

But if you just want to know how many apps are on your main search head, you can run this search:

| rest /services/apps/local | fields label title visible disabled configured core | stats count by disabled

This example breaks out the disabled vs. enabled apps

[kmorris_splunk · Accepted solution]

You can do this via rest. Try this first to get the list of apps:

| rest /services/apps/local | table label version

If you want a count of all the apps:

| rest /services/apps/local | stats count as numberofapps

If you just want enabled apps, you could use:

| rest /services/apps/local | search disabled=0 | stats count as numberofapps

[sheltomt]

Thank you! Exactly what I was looking for.