server class/apps gets updated by deployment server

[mailtosnsolutio]

Hello Splunkers,

Hope Everyone doing good.

I am for spl to create alert whenever a server class/apps gets updated by deployment server?

Could anyone please help ??

[adonio]

start here:
index=_internal component=PackageDownloadRestHandler host=* app=<YourAppNameHere>

or here:
index=_internal sourcetype=splunkd action=install

run in verbose and see how the events look like and write your own logic to answer the questions you care about

hope it helps