Monitoring Splunk

tracking who installed an app

a212830
Champion

Hi,

Is there a log that would show who/when an app was installed on a search-head?

Tags (2)

sideview
SplunkTrust
SplunkTrust

The _internal logs do keep a track of the POST requests that ultimately install an app.

For instance this search will pick up the usernames and app names of apps installed through the "Apps > Find more apps online" section. ie apps installed from the in-product integration with Splunkbase.

index=_internal sourcetype=splunkd_access method=POST uri="/services/apps/remote/*" | transaction user maxpause=10sec | stats count by file user | search file!="login"

That search however will probably need some tweaking if you're also needing to track apps installed via "Manager > Apps > Install app from file".

However if you want to track apps installed via shutting Splunk down, manually copying in the app directory and starting Splunk, it would be tricky even to pinpoint the time at which a new app appeared. The best you could do would be to track the usage of all apps and thus find the earliest times each app had ever been used. You could draw a correlation to login times and get some good clues, but that's all they'd be.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...