Deployment Architecture

Application Inventory

adalbor
Builder

Does anyone know an easy way to inventory installed applications across all components in your Splunk environment?

Deployment server doesn't really list the actual app versions and I was hoping to find a way to keep an updated app inventory for when we perform upgrades to our environment.

I know I can get the app versions from the Manage Apps page on ES and SHC but was hoping for an easier way.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Unfortunately, there is no one place that has all of the apps in your Splunk environment. The deployment server has the apps on your forwarders, the cluster master knows the apps on your indexers, and the deployer knows the apps on your clustered search heads. Those may be the same or different instances. Then there are the apps installed on DS, CM, and deployer themselves, not to mention any stand-alone search heads (like ES).
There is a REST command (rest /services/apps/local) to get a list of apps. Perhaps you write a script that sends the command to all instances and collates the results.
I'm afraid there is no "easy button" for this.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Unfortunately, there is no one place that has all of the apps in your Splunk environment. The deployment server has the apps on your forwarders, the cluster master knows the apps on your indexers, and the deployer knows the apps on your clustered search heads. Those may be the same or different instances. Then there are the apps installed on DS, CM, and deployer themselves, not to mention any stand-alone search heads (like ES).
There is a REST command (rest /services/apps/local) to get a list of apps. Perhaps you write a script that sends the command to all instances and collates the results.
I'm afraid there is no "easy button" for this.

---
If this reply helps you, Karma would be appreciated.

adalbor
Builder

That really stinks. Thanks for the info on using REST.

Just gotta do it the hard way I suppose.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...