Is there a way to determine the install date for Splunk universal forwarders?

[jwalzerpitt]

We are using SCCM to install Splunk Universal Forwarder in our organization and via our Deployment server, I can keep track of when the UF is installed on endpoints.

Is there a way via a search or using the REST API to see what the install date is for each UF?
Being that we're doing a rolling install I'd like to keep track of which date the UF was installed on each endpoint.

Thx

[Nealium]

For my instance, though there was no official "install date" recorded, you can use the first instances of splunkd logs to be able to estimate when a machine was installed with a splunk agent, I used the following:

| tstats min(_time) as firsttime, count where index=_internal AND source=*splunkd* by host
| eval nowtime=now()-604800
| where firsttime>nowtime

Which essentially says go back to and find the earliest instance of a log, if it is within the last week then it is an assumed new machine and we will record it, otherwise remove it from the list. Is this method perfect? no but it will get you a ballpark of machines onboarded in the past week.

Best solution would probably be to create a saved search to record every new instance of a machine in the past 24 hours and append it to a lookup.

[KARANMALHOTRA]

Found a similar question to yours. Please check if this applies to your scenario. https://answers.splunk.com/answers/137728/is-there-any-meta-data-that-identifies-when-a-splunk-agent...