Splunk Search

Is there a way to list enabled apps from the CLI?

Splunk Employee
Splunk Employee

I thought there was a way to enumerate the enabled and disabled apps from the CLI. Is this so, and if so, what is it?

1 Solution

Splunk Employee
Splunk Employee
splunk display app

Prints lines like

  SplunkLightForwarder       DISABLED  INVISIBLE  UNCONFIGURED
  unix                       ENABLED   VISIBLE    CONFIGURED

, so you could pipe output to awk '$2=="ENABLED" {print $1}', or some such.

View solution in original post

Splunk Employee
Splunk Employee

The CLI command would be: $SPLUNK_HOME/bin/splunk display app -auth login:password

or under Windows: %SPLUNK_HOME%\bin\splunk display app -auth login:password

eg. $SPLUNK_HOME/bin/splunk display app -auth admin:changeme

This and other admin CLI commands can be referenced at: http://www.splunk.com/base/Documentation/4.1.1/Admin/CLIadmincommands

Communicator

From the CLI:

"Splunk_Home"/splunk display app

This should list all the apps and let you know if they are enabled or disabled.

http://www.splunk.com/base/Documentation/4.1.1/Admin/CLIadmincommands

Travis.

Splunk Employee
Splunk Employee

Note that in older versions of splunk the variation whithout a specific app mentioned does nothing. This changed early in the 4.0.x series, I believe.

0 Karma

Champion

Run the following command:

$SPLUNK_HOME/bin/splunk display app

<requires authentication>

Result:

  gettingstarted             ENABLED   VISIBLE    CONFIGURED  

  launcher                   ENABLED   VISIBLE    CONFIGURED  

  learned                    ENABLED   INVISIBLE  CONFIGURED  

  sample_app                 ENABLED   INVISIBLE  CONFIGURED  

  search                     ENABLED   VISIBLE    CONFIGURED  

  SplunkForwarder            DISABLED  INVISIBLE  CONFIGURED  

  SplunkLightForwarder       ENABLED   INVISIBLE  CONFIGURED  

  unix                       DISABLED  VISIBLE    CONFIGURED  

Splunk Employee
Splunk Employee

In Powershell that would be

splunk display app | select-string "ENABLED"

or

| findstr "ENABLED"

if you're an adept of Windows CMD shell

Splunk Employee
Splunk Employee
splunk display app

Prints lines like

  SplunkLightForwarder       DISABLED  INVISIBLE  UNCONFIGURED
  unix                       ENABLED   VISIBLE    CONFIGURED

, so you could pipe output to awk '$2=="ENABLED" {print $1}', or some such.

View solution in original post

Splunk Employee
Splunk Employee

In general, splunk help commands prints a nice summary of CLI commands -- you can generally figure out from there. (That's how I learned answer to this question.)

0 Karma