Splunk Dev

Where does rest/services/apps/local get data?

joshuapetitt
Path Finder

I'm trying to get a list of installed addons for both local server instances and for deployed addons.

I've tried using the search:

| rest /services/apps/local

however, I am wondering where this data is coming from? For instance, I had an app in opt/splunk/etc/apps, but I have since deleted that specific app folder. However it still shows in the list?

Also, I have apps which I installed via the interface, but have then moved to deployment-apps (they are meant to be deployment apps). They show in the search results, but I'm wondering why? Should they?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Data for those rest api endpoint is stored in memory and is updated when Splunk restarts/refreshes/reloaded. You must not have restarted Splunk after you deleted that app, hence the data for /services/apps/local is not updated. Just get Splunk restarted and try again.

View solution in original post

somesoni2
Revered Legend

Data for those rest api endpoint is stored in memory and is updated when Splunk restarts/refreshes/reloaded. You must not have restarted Splunk after you deleted that app, hence the data for /services/apps/local is not updated. Just get Splunk restarted and try again.

joshuapetitt
Path Finder

@somesoni2, thank you! That fixed the issue, and makes sense now. If you make this an answer, I'll accept.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...