Splunk Search

Is there a way to list enabled apps from the CLI?

gkanapathy
Splunk Employee
Splunk Employee

I thought there was a way to enumerate the enabled and disabled apps from the CLI. Is this so, and if so, what is it?

1 Solution

V_at_Splunk
Splunk Employee
Splunk Employee
splunk display app

Prints lines like

  SplunkLightForwarder       DISABLED  INVISIBLE  UNCONFIGURED
  unix                       ENABLED   VISIBLE    CONFIGURED

, so you could pipe output to awk '$2=="ENABLED" {print $1}', or some such.

View solution in original post

Ellen
Splunk Employee
Splunk Employee

The CLI command would be: $SPLUNK_HOME/bin/splunk display app -auth login:password

or under Windows: %SPLUNK_HOME%\bin\splunk display app -auth login:password

eg. $SPLUNK_HOME/bin/splunk display app -auth admin:changeme

This and other admin CLI commands can be referenced at: http://www.splunk.com/base/Documentation/4.1.1/Admin/CLIadmincommands

thall79
Communicator

From the CLI:

"Splunk_Home"/splunk display app

This should list all the apps and let you know if they are enabled or disabled.

http://www.splunk.com/base/Documentation/4.1.1/Admin/CLIadmincommands

Travis.

jrodman
Splunk Employee
Splunk Employee

Note that in older versions of splunk the variation whithout a specific app mentioned does nothing. This changed early in the 4.0.x series, I believe.

0 Karma

the_wolverine
Champion

Run the following command:

$SPLUNK_HOME/bin/splunk display app

<requires authentication>

Result:

  gettingstarted             ENABLED   VISIBLE    CONFIGURED  

  launcher                   ENABLED   VISIBLE    CONFIGURED  

  learned                    ENABLED   INVISIBLE  CONFIGURED  

  sample_app                 ENABLED   INVISIBLE  CONFIGURED  

  search                     ENABLED   VISIBLE    CONFIGURED  

  SplunkForwarder            DISABLED  INVISIBLE  CONFIGURED  

  SplunkLightForwarder       ENABLED   INVISIBLE  CONFIGURED  

  unix                       DISABLED  VISIBLE    CONFIGURED  

Leo
Splunk Employee
Splunk Employee

In Powershell that would be

splunk display app | select-string "ENABLED"

or

| findstr "ENABLED"

if you're an adept of Windows CMD shell

V_at_Splunk
Splunk Employee
Splunk Employee
splunk display app

Prints lines like

  SplunkLightForwarder       DISABLED  INVISIBLE  UNCONFIGURED
  unix                       ENABLED   VISIBLE    CONFIGURED

, so you could pipe output to awk '$2=="ENABLED" {print $1}', or some such.

V_at_Splunk
Splunk Employee
Splunk Employee

In general, splunk help commands prints a nice summary of CLI commands -- you can generally figure out from there. (That's how I learned answer to this question.)

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...