How to create a report that lists of all enabled apps on Splunk Universal Forwarders and their versions?

[paoloromagnoli]

I would like to create a report/dashboard that includes among other things the list of Splunk apps installed on universal forwarders and their versions.
I created the report for apps installed on heavy forwarders and other Splunk components using the REST API. Any idea for universal forwarders? Also on the deployment server I was not able to spot if that info is indexed somewhere

[gcusello]

Hi @paoloromagnoli,

try this

| rest splunk_server=local /services/deployment/server/clients
| table hostname ip utsname *.restartSplunkd
| eval temp=hostname."#".ip."#".utsname 
| table temp *.restartSplunkd
| eval application.NoApp.restartSplunkd=0
| untable temp apps count 
| eval Apps=if(like(apps,"app%"),mvindex(split(apps,"."),1),null()) 
| eval ServerClass=if(like(apps,"server%"),mvindex(split(apps,"."),1),null() ) 
| rex field=temp "(?<Host>.*)#(?<Host_IP>.*)#(?<Machine_Type>.*)" 
| table Host Host_IP Machine_Type Apps ServerClass 
| stats Values(*) as * dc(Apps) AS dc_apps by Host Host_IP Machine_Type
| eval Apps=if(dc_apps=1,Apps,mvindex(Apps,1,10))
| nomv Apps
| nomv ServerClass
| fillnull value="NoSC" ServerClass

Ciao.

Giuseppe

[Abha111]

Hi Paoloromagnoli,

Could you please share the rest query you used to create a report for apps installed on heavy forwarders and other Splunk components using the REST API.

[woodcock · Accepted solution]

This would make an excellent Modular Input App exercise. Your script will go to $SPLUNK_HOME/etc/apps/ and list out each directory and then go into each application directory and look for a app.conf file first in local and then in default. Inside of that find the line that says version=valiue line and grab the value. There might be an app on Splunkbase that already does this.

[paoloromagnoli]

That was my first idea... I was only trying to seeif that info was already present some where in some index
Thanks,
Paolo