How do I find a list of Built-in (pre-installed) Apps & Add-ons that come with Splunk Ent. & Splunk ES

[SamHTexas]

Please help me find a list of pre-installed Apps & TAs that come with Splunk Enterprise & Splunk ES. Thank u in advance.

[richgalloway · Accepted solution]

I'm not aware of any documented list, but you can get a list of built-in Splunk apps with this query.

| rest /services/apps/local splunk_server=local | search core=1 | table title

There's a similar query for ES, but it's not as clean.  This one looks for apps with the version string as ES, which isn't foolproof.

| rest /services/apps/local splunk_server=local 
| search version="6.2.0" ```Change to your ES version```
| table title

Also, you can install a new Splunk instance and examine what's in $SPLUNK_HOME/etc/apps.

Do the same with ES.

[SamHTexas]

One question sir, to update Apps on Splunk Ent / ES do I just download the new version & install it on the top of the old one? Thank u sir & have a super weekend.

[richgalloway]

There are several ways to update an app.  Choose the one appropriate for the app/TA and the Splunk instance.  Some apps have installation instructions so be sure to follow them.

• Click the "Update" link on the Manage Apps screen.
• Download the app from splunkbase then go to Manage Apps and click Install App from File.  Be sure to check the "Upgrade" box.
• Download the app from splunkbase and untar it in $SPLUNK_HOME/etc/apps and restart the instance.
• Download the app from splunkbase and untar it on the SHC deployer and apply the shbundle.
• Download the app from splunkbase and untar it on the CM and apply the bundle.
• Download the app from splunkbase and untar it on the deployment server.

[SamHTexas]

Thank u very much. You are an asset to this site as always. I have learned plenty from you sir.

[SamHTexas]

Thank u very much bro. When searching for Apps, do the SPLs you listed print the list of TAs as well? If not is there separate SPL for TAs?

[richgalloway]

TAs are apps and will show up in the same SPL results.