Splunk Dev

Where does rest/services/apps/local get data?

joshuapetitt
Path Finder

I'm trying to get a list of installed addons for both local server instances and for deployed addons.

I've tried using the search:

| rest /services/apps/local

however, I am wondering where this data is coming from? For instance, I had an app in opt/splunk/etc/apps, but I have since deleted that specific app folder. However it still shows in the list?

Also, I have apps which I installed via the interface, but have then moved to deployment-apps (they are meant to be deployment apps). They show in the search results, but I'm wondering why? Should they?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Data for those rest api endpoint is stored in memory and is updated when Splunk restarts/refreshes/reloaded. You must not have restarted Splunk after you deleted that app, hence the data for /services/apps/local is not updated. Just get Splunk restarted and try again.

View solution in original post

somesoni2
Revered Legend

Data for those rest api endpoint is stored in memory and is updated when Splunk restarts/refreshes/reloaded. You must not have restarted Splunk after you deleted that app, hence the data for /services/apps/local is not updated. Just get Splunk restarted and try again.

joshuapetitt
Path Finder

@somesoni2, thank you! That fixed the issue, and makes sense now. If you make this an answer, I'll accept.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...