It basically does fschange:// on the directory containing deployment server files. You can see results of this in the _audit index, look for any actions with the /deployment-server/ in path, i.e.: index=_audit path="*deployment-apps*" You will see all file modifications that Splunk detected. Once a file in an app has been modified, Splunk calculates checksum of the whole directory. This checksum is given to agents when they download the app initially. Upon checking if something changed, the agents compare the current checksum they have with the one supplied by the server, if it doesn't match the application is downloaded and installed. ... View more