How do I check to see if my Splunk Technology add-ons (TAs) are working properly on Splunk Ent or ES? Thanks a mil.

[SamHTexas]

Since TAs run in the background & usually not viewed, how do I check on their health? Any useful SPLs are appreciated.

[PickleRick]

What do you mean by "TA-s run in background"?

TA-s on its own don't "run". They might provide some scripted/modular inputs and then you might simply monitor the destination indexes, but often they just contain props/transforms/lookups.

[SamHTexas]

Thank u for your response. Am familiar with TAs function. What I mean is they are not visible like apps that do a certain function. So we download TA like we do with Apps. What am looking for is a SPL to tell me if a TA is broken or did not install properly & not doing it's duty. Please advise.

[PickleRick]

How would you like to decide (especially without knowing details of particular TA) whether it's doing its job or not?

For example - you install a TA for windows but misconfigure the inputs on your UF-s and they send the data with wrong sourcetype so no props/transforms from said TA are applied in searchtime because they don't catch the events. How would you like to detect that?