Where does rest/services/apps/local get data?

[joshuapetitt]

I'm trying to get a list of installed addons for both local server instances and for deployed addons.

I've tried using the search:

| rest /services/apps/local

however, I am wondering where this data is coming from? For instance, I had an app in opt/splunk/etc/apps, but I have since deleted that specific app folder. However it still shows in the list?

Also, I have apps which I installed via the interface, but have then moved to deployment-apps (they are meant to be deployment apps). They show in the search results, but I'm wondering why? Should they?

[somesoni2 · Accepted solution]

Data for those rest api endpoint is stored in memory and is updated when Splunk restarts/refreshes/reloaded. You must not have restarted Splunk after you deleted that app, hence the data for /services/apps/local is not updated. Just get Splunk restarted and try again.

[joshuapetitt]

@somesoni2, thank you! That fixed the issue, and makes sense now. If you make this an answer, I'll accept.