Splunk Search

Improve query to list apps and versions on all indexer nodes

radam2000
Path Finder

I have this query to list the apps and their versions last update date for apps on all index nodes, however the updated date lists a default for all apps as "1969-12-31T19:00:00-05:00". Anyway to modify this to produce the proper updated date?

| rest /services/apps/local | search disabled=* |table splunk_server, title, label, version, updated, disabled, visible, description, author, configured, core, "eai:acl.app", "eai:acl.sharing", id

thanks in advance for any assistance...

Rich

Tags (1)
0 Karma

radam2000
Path Finder

It does not provide a correct update date for any entry - note output of query does show disabled field which contains both entries with 0 and 1 for true and false annd update date is the same

Thanks for your reply
Rich

0 Karma

DalJeanis
Legend

Does it list the correct updated date/time for apps that are not disabled?

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...