Hello Splunkers,
Hope Everyone doing good.
I am for spl to create alert whenever a server class/apps gets updated by deployment server?
Could anyone please help ??
start here:
index=_internal component=PackageDownloadRestHandler host=* app=<YourAppNameHere>
or here:
index=_internal sourcetype=splunkd action=install
run in verbose and see how the events look like and write your own logic to answer the questions you care about
hope it helps