How can we find out whether the Splunk App for Windows Infrastructure is being used?

[danielbb]

This app has been giving us many skipped searches and maintenance issues at Why does the tSessions_Lookup_Update report take a long time to complete?

Is there a way to find out if the app has being used? is there a dedicated index for this app?

[tauliang]

Since every app when invoked first can only be accessed by invoking the app ur, you can find out the apps being used by searching the index=_internal and sourcetype=splunk_web_access to find all the invocations of the app url like this:

    index=_internal  sourcetype=splunk_web_access
     | rex ".*\"(?<url>http(s)*\:\/\/[^\"]+)\"" 
     | rex field=url "http(s)*\:\/\/(?<domain>[^\:]+)\:(?<port>[^\/]+)\/.*\/app\/(?<appName>[^\/]+).*" 
     | table appName 
     | dedup appName

This will take care of the app part. That said, since Splunk App for Windows Infrastructure has some knowledge objects that are shared, you will have to check them individually.