I thought there was a way to enumerate the enabled and disabled apps from the CLI. Is this so, and if so, what is it?
splunk display app
Prints lines like
SplunkLightForwarder DISABLED INVISIBLE UNCONFIGURED
unix ENABLED VISIBLE CONFIGURED
, so you could pipe output to awk '$2=="ENABLED" {print $1}'
, or some such.
The CLI command would be: $SPLUNK_HOME/bin/splunk display app -auth login:password
or under Windows: %SPLUNK_HOME%\bin\splunk display app -auth login:password
eg. $SPLUNK_HOME/bin/splunk display app -auth admin:changeme
This and other admin CLI commands can be referenced at: http://www.splunk.com/base/Documentation/4.1.1/Admin/CLIadmincommands
From the CLI:
"Splunk_Home"/splunk display app
This should list all the apps and let you know if they are enabled or disabled.
http://www.splunk.com/base/Documentation/4.1.1/Admin/CLIadmincommands
Travis.
Note that in older versions of splunk the variation whithout a specific app mentioned does nothing. This changed early in the 4.0.x series, I believe.
Run the following command:
$SPLUNK_HOME/bin/splunk display app
<requires authentication>
Result:
gettingstarted ENABLED VISIBLE CONFIGURED
launcher ENABLED VISIBLE CONFIGURED
learned ENABLED INVISIBLE CONFIGURED
sample_app ENABLED INVISIBLE CONFIGURED
search ENABLED VISIBLE CONFIGURED
SplunkForwarder DISABLED INVISIBLE CONFIGURED
SplunkLightForwarder ENABLED INVISIBLE CONFIGURED
unix DISABLED VISIBLE CONFIGURED
In Powershell that would be
splunk display app | select-string "ENABLED"
or
| findstr "ENABLED"
if you're an adept of Windows CMD shell
splunk display app
Prints lines like
SplunkLightForwarder DISABLED INVISIBLE UNCONFIGURED
unix ENABLED VISIBLE CONFIGURED
, so you could pipe output to awk '$2=="ENABLED" {print $1}'
, or some such.
In general, splunk help commands
prints a nice summary of CLI commands -- you can generally figure out from there. (That's how I learned answer to this question.)