Is there any history of the apps downloaded to my universal forwarders from my deployment server?
index=_internal will provide historical data for the last 30 days (that's the default retention for this index). If you search like this:
index=_internal sourcetype=splunkd deployedapplication
you will get a nice bunch of information out of it.
Hope this helps ...
View solution in original post