All Apps and Add-ons

How can we find out whether the Splunk App for Windows Infrastructure is being used?

danielbb
Motivator

This app has been giving us many skipped searches and maintenance issues at Why does the tSessions_Lookup_Update report take a long time to complete?

Is there a way to find out if the app has being used? is there a dedicated index for this app?

tauliang
Communicator

Since every app when invoked first can only be accessed by invoking the app ur, you can find out the apps being used by searching the index=_internal and sourcetype=splunk_web_access to find all the invocations of the app url like this:

    index=_internal  sourcetype=splunk_web_access
     | rex ".*\"(?<url>http(s)*\:\/\/[^\"]+)\"" 
     | rex field=url "http(s)*\:\/\/(?<domain>[^\:]+)\:(?<port>[^\/]+)\/.*\/app\/(?<appName>[^\/]+).*" 
     | table appName 
     | dedup appName

This will take care of the app part. That said, since Splunk App for Windows Infrastructure has some knowledge objects that are shared, you will have to check them individually.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!