Getting Data In
Highlighted

Is there any history of the apps downloaded to my universal forwarders from my deployment server?

Motivator

Is there any history of the apps downloaded to my universal forwarders from my deployment server?

0 Karma
Highlighted

Re: Is there any history of the apps downloaded to my universal forwarders from my deployment server?

SplunkTrust
SplunkTrust

Hi lycollicott,

index=_internal will provide historical data for the last 30 days (that's the default retention for this index). If you search like this:

index=_internal sourcetype=splunkd deployedapplication

you will get a nice bunch of information out of it.

Hope this helps ...

cheers, MuS

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.