Splunk Search

Improve query to list apps and versions on all indexer nodes

radam2000
Path Finder

I have this query to list the apps and their versions last update date for apps on all index nodes, however the updated date lists a default for all apps as "1969-12-31T19:00:00-05:00". Anyway to modify this to produce the proper updated date?

| rest /services/apps/local | search disabled=* |table splunk_server, title, label, version, updated, disabled, visible, description, author, configured, core, "eai:acl.app", "eai:acl.sharing", id

thanks in advance for any assistance...

Rich

Tags (1)
0 Karma

radam2000
Path Finder

It does not provide a correct update date for any entry - note output of query does show disabled field which contains both entries with 0 and 1 for true and false annd update date is the same

Thanks for your reply
Rich

0 Karma

DalJeanis
Legend

Does it list the correct updated date/time for apps that are not disabled?

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...