Splunk Search

Is there internal Splunk data I can search to find the latest timestamp when an app from Splunkbase was installed?

nibinabr
Communicator

Is there a splunk search that I can use to find the latest timestamp when an app was installed? Is there an internal index that contains this information?

0 Karma

dolivasoh
Contributor

Assuming the logs contain something like "installed",

index=blah sourcetype=blah app_name "installed" | stats latest(_time) as Time

0 Karma

nibinabr
Communicator

I think my question wasn't clear enough. Which index and sourcetype are you referring to here ? My logs doesn't contain this info. Are there any logs internal to splunk that keeps track of this information ? I'm trying to find the last time an app was installed (or a newer version of the app is installed).

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...