Splunk Search

Is there a way to determine the install date for Splunk universal forwarders?

jwalzerpitt
Influencer

We are using SCCM to install Splunk Universal Forwarder in our organization and via our Deployment server, I can keep track of when the UF is installed on endpoints.

Is there a way via a search or using the REST API to see what the install date is for each UF?
Being that we're doing a rolling install I'd like to keep track of which date the UF was installed on each endpoint.

Thx

KARANMALHOTRA
Path Finder

Found a similar question to yours. Please check if this applies to your scenario. https://answers.splunk.com/answers/137728/is-there-any-meta-data-that-identifies-when-a-splunk-agent...

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...