Knowledge Management

How do I find a list of Built-in (pre-installed) Apps & Add-ons that come with Splunk Ent. & Splunk ES

SamHTexas
Builder

Please help me find a list of pre-installed Apps & TAs that come with Splunk Enterprise & Splunk ES. Thank u in advance.

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of any documented list, but you can get a list of built-in Splunk apps with this query.

| rest /services/apps/local splunk_server=local | search core=1 | table title

There's a similar query for ES, but it's not as clean.  This one looks for apps with the version string as ES, which isn't foolproof.

| rest /services/apps/local splunk_server=local 
| search version="6.2.0" ```Change to your ES version```
| table title

Also, you can install a new Splunk instance and examine what's in $SPLUNK_HOME/etc/apps.

Do the same with ES.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of any documented list, but you can get a list of built-in Splunk apps with this query.

| rest /services/apps/local splunk_server=local | search core=1 | table title

There's a similar query for ES, but it's not as clean.  This one looks for apps with the version string as ES, which isn't foolproof.

| rest /services/apps/local splunk_server=local 
| search version="6.2.0" ```Change to your ES version```
| table title

Also, you can install a new Splunk instance and examine what's in $SPLUNK_HOME/etc/apps.

Do the same with ES.

---
If this reply helps you, Karma would be appreciated.

SamHTexas
Builder

One question sir, to update Apps on Splunk Ent / ES do I just download the new version & install it on the top of the old one? Thank u sir & have a super weekend.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are several ways to update an app.  Choose the one appropriate for the app/TA and the Splunk instance.  Some apps have installation instructions so be sure to follow them.

  • Click the "Update" link on the Manage Apps screen.
  • Download the app from splunkbase then go to Manage Apps and click Install App from File.  Be sure to check the "Upgrade" box.
  • Download the app from splunkbase and untar it in $SPLUNK_HOME/etc/apps and restart the instance.
  • Download the app from splunkbase and untar it on the SHC deployer and apply the shbundle.
  • Download the app from splunkbase and untar it on the CM and apply the bundle.
  • Download the app from splunkbase and untar it on the deployment server.

 

---
If this reply helps you, Karma would be appreciated.

SamHTexas
Builder

Thank u very much. You are an asset to this site as always. I have learned plenty from you sir.

Tags (1)

SamHTexas
Builder

Thank u very much bro. When searching for Apps, do the SPLs you listed print the list of TAs as well? If not is there separate SPL for TAs?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

TAs are apps and will show up in the same SPL results.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...