Is there any history of the apps downloaded to my universal forwarders from my deployment server?

[lycollicott]

Is there any history of the apps downloaded to my universal forwarders from my deployment server?

[MuS · Accepted solution]

Hi lycollicott,

index=_internal will provide historical data for the last 30 days (that's the default retention for this index). If you search like this:

index=_internal sourcetype=splunkd deployedapplication

you will get a nice bunch of information out of it.

Hope this helps ...

cheers, MuS