Knowledge Management

How do I find a list of Built-in (pre-installed) Apps & Add-ons that come with Splunk Ent. & Splunk ES

SamHTexas
Builder

Please help me find a list of pre-installed Apps & TAs that come with Splunk Enterprise & Splunk ES. Thank u in advance.

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of any documented list, but you can get a list of built-in Splunk apps with this query.

| rest /services/apps/local splunk_server=local | search core=1 | table title

There's a similar query for ES, but it's not as clean.  This one looks for apps with the version string as ES, which isn't foolproof.

| rest /services/apps/local splunk_server=local 
| search version="6.2.0" ```Change to your ES version```
| table title

Also, you can install a new Splunk instance and examine what's in $SPLUNK_HOME/etc/apps.

Do the same with ES.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of any documented list, but you can get a list of built-in Splunk apps with this query.

| rest /services/apps/local splunk_server=local | search core=1 | table title

There's a similar query for ES, but it's not as clean.  This one looks for apps with the version string as ES, which isn't foolproof.

| rest /services/apps/local splunk_server=local 
| search version="6.2.0" ```Change to your ES version```
| table title

Also, you can install a new Splunk instance and examine what's in $SPLUNK_HOME/etc/apps.

Do the same with ES.

---
If this reply helps you, Karma would be appreciated.

SamHTexas
Builder

One question sir, to update Apps on Splunk Ent / ES do I just download the new version & install it on the top of the old one? Thank u sir & have a super weekend.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are several ways to update an app.  Choose the one appropriate for the app/TA and the Splunk instance.  Some apps have installation instructions so be sure to follow them.

  • Click the "Update" link on the Manage Apps screen.
  • Download the app from splunkbase then go to Manage Apps and click Install App from File.  Be sure to check the "Upgrade" box.
  • Download the app from splunkbase and untar it in $SPLUNK_HOME/etc/apps and restart the instance.
  • Download the app from splunkbase and untar it on the SHC deployer and apply the shbundle.
  • Download the app from splunkbase and untar it on the CM and apply the bundle.
  • Download the app from splunkbase and untar it on the deployment server.

 

---
If this reply helps you, Karma would be appreciated.

SamHTexas
Builder

Thank u very much. You are an asset to this site as always. I have learned plenty from you sir.

Tags (1)

SamHTexas
Builder

Thank u very much bro. When searching for Apps, do the SPLs you listed print the list of TAs as well? If not is there separate SPL for TAs?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

TAs are apps and will show up in the same SPL results.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...