I am doing an inventory of all apps on my search head - but one I have noticed is not listed - I have thrown the kitchen sink at it .
I go to all configurations as the TA UFMA - Unified Forwarder Monitoring and Alerting for Splunk, I also see it in the Apps drop down menu, and I see it in the Managed Apps page.
Here is the syntax I am using - is there a better search string I should be using to pick on all TA and Add-ons ?
| rest /services/apps/local | search disabled=* | table label version
try this
| rest /servicesNS/-/-/admin/directory count=0 splunk_server=local | fields eai:acl.app, eai:acl.owner, eai:acl.perms.*, eai:acl.sharing, title, eai:type, disabled
| foreach eai:*.*
[ rename "<<FIELD>>" TO <<MATCHSEG2>> ]
| foreach eai:*
[ rename "<<FIELD>>" TO <<MATCHSTR>> ]
| eval attribute=replace(title,"(.*:\s+)(.*)","\2")
| eval st=replace(title,"(.*)(\s+:.*)","\1")
| eval props_sourcetype=if(st==attribute,"",st)
| join type=outer attribute
[| rest /servicesNS/-/-/admin/props-extract count=0 splunk_server=local | fields attribute value stanza type | rename value TO props_value, stanza to props_stanza, type to props_type ]
| join type=outer attribute
[| rest /servicesNS/-/-/admin/transforms-extract count=0 splunk_server=local
| fields REGEX FORMAT disabled eai:acl.app title FIELDS
| makemv delim="," FIELDS
| rename FIELDS to tf_fields, disabled to tf_disabled, REGEX to tf_regex, FORMAT to tf_format, title to attribute, eai:acl.app to tf_app]
| fillnull disabled tf_disabled
| table disabled app type attribute props_type props_stanza props_value props_sourcetype tf_disabled tf_format tf_fields tf_regex sharing perms.* location owner | search (app="*" AND (sharing="*")) AND disabled=*
| rename attribute TO "Object Name"
try this
| rest /servicesNS/-/-/admin/directory count=0 splunk_server=local | fields eai:acl.app, eai:acl.owner, eai:acl.perms.*, eai:acl.sharing, title, eai:type, disabled
| foreach eai:*.*
[ rename "<<FIELD>>" TO <<MATCHSEG2>> ]
| foreach eai:*
[ rename "<<FIELD>>" TO <<MATCHSTR>> ]
| eval attribute=replace(title,"(.*:\s+)(.*)","\2")
| eval st=replace(title,"(.*)(\s+:.*)","\1")
| eval props_sourcetype=if(st==attribute,"",st)
| join type=outer attribute
[| rest /servicesNS/-/-/admin/props-extract count=0 splunk_server=local | fields attribute value stanza type | rename value TO props_value, stanza to props_stanza, type to props_type ]
| join type=outer attribute
[| rest /servicesNS/-/-/admin/transforms-extract count=0 splunk_server=local
| fields REGEX FORMAT disabled eai:acl.app title FIELDS
| makemv delim="," FIELDS
| rename FIELDS to tf_fields, disabled to tf_disabled, REGEX to tf_regex, FORMAT to tf_format, title to attribute, eai:acl.app to tf_app]
| fillnull disabled tf_disabled
| table disabled app type attribute props_type props_stanza props_value props_sourcetype tf_disabled tf_format tf_fields tf_regex sharing perms.* location owner | search (app="*" AND (sharing="*")) AND disabled=*
| rename attribute TO "Object Name"