Is there any history of the apps downloaded to my universal forwarders from my deployment server?
Hi lycollicott,
index=_internal
will provide historical data for the last 30 days (that's the default retention for this index). If you search like this:
index=_internal sourcetype=splunkd deployedapplication
you will get a nice bunch of information out of it.
Hope this helps ...
cheers, MuS
Hi lycollicott,
index=_internal
will provide historical data for the last 30 days (that's the default retention for this index). If you search like this:
index=_internal sourcetype=splunkd deployedapplication
you will get a nice bunch of information out of it.
Hope this helps ...
cheers, MuS