Knowledge Management

How do I find a list of Built-in (pre-installed) Apps & Add-ons that come with Splunk Ent. & Splunk ES

SamHTexas
Builder

Please help me find a list of pre-installed Apps & TAs that come with Splunk Enterprise & Splunk ES. Thank u in advance.

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of any documented list, but you can get a list of built-in Splunk apps with this query.

| rest /services/apps/local splunk_server=local | search core=1 | table title

There's a similar query for ES, but it's not as clean.  This one looks for apps with the version string as ES, which isn't foolproof.

| rest /services/apps/local splunk_server=local 
| search version="6.2.0" ```Change to your ES version```
| table title

Also, you can install a new Splunk instance and examine what's in $SPLUNK_HOME/etc/apps.

Do the same with ES.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of any documented list, but you can get a list of built-in Splunk apps with this query.

| rest /services/apps/local splunk_server=local | search core=1 | table title

There's a similar query for ES, but it's not as clean.  This one looks for apps with the version string as ES, which isn't foolproof.

| rest /services/apps/local splunk_server=local 
| search version="6.2.0" ```Change to your ES version```
| table title

Also, you can install a new Splunk instance and examine what's in $SPLUNK_HOME/etc/apps.

Do the same with ES.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SamHTexas
Builder

One question sir, to update Apps on Splunk Ent / ES do I just download the new version & install it on the top of the old one? Thank u sir & have a super weekend.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are several ways to update an app.  Choose the one appropriate for the app/TA and the Splunk instance.  Some apps have installation instructions so be sure to follow them.

  • Click the "Update" link on the Manage Apps screen.
  • Download the app from splunkbase then go to Manage Apps and click Install App from File.  Be sure to check the "Upgrade" box.
  • Download the app from splunkbase and untar it in $SPLUNK_HOME/etc/apps and restart the instance.
  • Download the app from splunkbase and untar it on the SHC deployer and apply the shbundle.
  • Download the app from splunkbase and untar it on the CM and apply the bundle.
  • Download the app from splunkbase and untar it on the deployment server.

 

---
If this reply helps you, an upvote would be appreciated.

SamHTexas
Builder

Thank u very much. You are an asset to this site as always. I have learned plenty from you sir.

Tags (1)

SamHTexas
Builder

Thank u very much bro. When searching for Apps, do the SPLs you listed print the list of TAs as well? If not is there separate SPL for TAs?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

TAs are apps and will show up in the same SPL results.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.