Splunk Search

Delemma when searching Apps a particular TA is not in the list for all apps ? where is it ?

jcorcoran508
Path Finder

I am doing an inventory of all apps on my search head -  but one I have noticed is not listed - I have thrown the kitchen sink at it .

I go to all configurations as the  TA  UFMA - Unified Forwarder Monitoring and Alerting for Splunk, I also see it in the Apps drop down menu, and I see it in the Managed Apps page.

Here is the syntax I am using - is there a better search string I should be using to pick on all TA and Add-ons ?

| rest /services/apps/local | search disabled=* | table label version

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

aasabatini
Motivator

Hi @jcorcoran508 

try this

| rest /servicesNS/-/-/admin/directory count=0 splunk_server=local | fields eai:acl.app, eai:acl.owner, eai:acl.perms.*, eai:acl.sharing, title, eai:type, disabled
| foreach eai:*.* 
    [ rename "<<FIELD>>" TO <<MATCHSEG2>> ]
| foreach eai:* 
    [ rename "<<FIELD>>" TO <<MATCHSTR>> ]
| eval attribute=replace(title,"(.*:\s+)(.*)","\2")
| eval st=replace(title,"(.*)(\s+:.*)","\1")
| eval props_sourcetype=if(st==attribute,"",st)
| join type=outer attribute
    [| rest /servicesNS/-/-/admin/props-extract count=0 splunk_server=local | fields attribute value stanza type | rename value TO props_value, stanza to props_stanza, type to props_type ]
| join type=outer attribute
    [| rest /servicesNS/-/-/admin/transforms-extract count=0 splunk_server=local
    | fields REGEX FORMAT disabled eai:acl.app title FIELDS
    | makemv delim="," FIELDS
    | rename FIELDS to tf_fields, disabled to tf_disabled, REGEX to tf_regex, FORMAT to tf_format, title to attribute, eai:acl.app to tf_app]
| fillnull disabled tf_disabled
| table disabled app type attribute props_type props_stanza props_value props_sourcetype tf_disabled tf_format tf_fields tf_regex sharing perms.* location owner |  search (app="*" AND (sharing="*")) AND disabled=*  
| rename attribute TO "Object Name"
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

aasabatini
Motivator

Hi @jcorcoran508 

try this

| rest /servicesNS/-/-/admin/directory count=0 splunk_server=local | fields eai:acl.app, eai:acl.owner, eai:acl.perms.*, eai:acl.sharing, title, eai:type, disabled
| foreach eai:*.* 
    [ rename "<<FIELD>>" TO <<MATCHSEG2>> ]
| foreach eai:* 
    [ rename "<<FIELD>>" TO <<MATCHSTR>> ]
| eval attribute=replace(title,"(.*:\s+)(.*)","\2")
| eval st=replace(title,"(.*)(\s+:.*)","\1")
| eval props_sourcetype=if(st==attribute,"",st)
| join type=outer attribute
    [| rest /servicesNS/-/-/admin/props-extract count=0 splunk_server=local | fields attribute value stanza type | rename value TO props_value, stanza to props_stanza, type to props_type ]
| join type=outer attribute
    [| rest /servicesNS/-/-/admin/transforms-extract count=0 splunk_server=local
    | fields REGEX FORMAT disabled eai:acl.app title FIELDS
    | makemv delim="," FIELDS
    | rename FIELDS to tf_fields, disabled to tf_disabled, REGEX to tf_regex, FORMAT to tf_format, title to attribute, eai:acl.app to tf_app]
| fillnull disabled tf_disabled
| table disabled app type attribute props_type props_stanza props_value props_sourcetype tf_disabled tf_format tf_fields tf_regex sharing perms.* location owner |  search (app="*" AND (sharing="*")) AND disabled=*  
| rename attribute TO "Object Name"
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...