Splunk Search

Improve query to list apps and versions on all indexer nodes

radam2000
Path Finder

I have this query to list the apps and their versions last update date for apps on all index nodes, however the updated date lists a default for all apps as "1969-12-31T19:00:00-05:00". Anyway to modify this to produce the proper updated date?

| rest /services/apps/local | search disabled=* |table splunk_server, title, label, version, updated, disabled, visible, description, author, configured, core, "eai:acl.app", "eai:acl.sharing", id

thanks in advance for any assistance...

Rich

Tags (1)
0 Karma

radam2000
Path Finder

It does not provide a correct update date for any entry - note output of query does show disabled field which contains both entries with 0 and 1 for true and false annd update date is the same

Thanks for your reply
Rich

0 Karma

DalJeanis
Legend

Does it list the correct updated date/time for apps that are not disabled?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...