Application Inventory

[adalbor]

Does anyone know an easy way to inventory installed applications across all components in your Splunk environment?

Deployment server doesn't really list the actual app versions and I was hoping to find a way to keep an updated app inventory for when we perform upgrades to our environment.

I know I can get the app versions from the Manage Apps page on ES and SHC but was hoping for an easier way.

[richgalloway · Accepted solution]

Unfortunately, there is no one place that has all of the apps in your Splunk environment. The deployment server has the apps on your forwarders, the cluster master knows the apps on your indexers, and the deployer knows the apps on your clustered search heads. Those may be the same or different instances. Then there are the apps installed on DS, CM, and deployer themselves, not to mention any stand-alone search heads (like ES).
There is a REST command (rest /services/apps/local) to get a list of apps. Perhaps you write a script that sends the command to all instances and collates the results.
I'm afraid there is no "easy button" for this.

[adalbor]

That really stinks. Thanks for the info on using REST.

Just gotta do it the hard way I suppose.