topic Re: How to write a search for a list of all different versions of an app? in Splunk Enterprise

How to write a search for a list of all different versions of an app?

Mat1 — Mon, 22 May 2023 16:53:01 GMT

I'm not so keen in creating Splunk query, so I would kindly ask your support for the following query:

I need to have a list with all different versions of an application currently installed on all PC's and related username, hostname and src ip. My draft query is the following:

index=* sourcetype=* "pippo app" | stats list(file_name) as "application" by src_user | table username, hostname, src_ip, application with version

Thank you in advance.

Re: How to write a search for a list of all different versions of an app?

richgalloway — Mon, 22 May 2023 17:23:01 GMT

What's wrong with the query you have? What does your data look like?

Re: How to write a search for a list of all different versions of an app?

Mat1 — Tue, 23 May 2023 07:56:49 GMT

My query doesn't work

Re: How to write a search for a list of all different versions of an app?

gcusello — Tue, 23 May 2023 14:42:24 GMT

Hi @Mat1 ,

what's the issue you experienced: no results or results different from expected,

if the second, could you share the result you have and the result you want?

at first after a stats command you have only the fields in the command, in your case, you have only "src_user" and "application".

If this is your issue, you have to add the other fields in the stats options using the values option.

Then, if you run only the main search, have you in interesting fields src_user and file_name?

if yse, check if in the same event you have both these fields abd check filenames.

Ciao.

Giuseppe

Re: How to write a search for a list of all different versions of an app?

Mat1 — Wed, 24 May 2023 06:46:46 GMT

Hi @gcusello ,

my previous query didn't give any results, because was wrong. This is my new query:

index=* "KeePass"
| table src_user, src_user_email, src_ip, file_name | dedup src_user

I need my query to show me the 'keepass' application and its version on each PC.
With this query it only finds me the .exe, .dll, etc. files, but I need to know the version installed on each PC.
Right now it correctly shows me "username", "password" and "IP" (although not everything, because I think there is some info missing in the raw file).

Re: How to write a search for a list of all different versions of an app?

gcusello — Wed, 24 May 2023 08:38:41 GMT

Hi @Mat1 ,

where is stored the information about version?

if you haven't this information see if it's possible to extract it using a script.

Ciao.

Giuseppe

Re: How to write a search for a list of all different versions of an app?

Mat1 — Wed, 24 May 2023 17:52:51 GMT

Hi @gcusello ,

ok, I'll try to get this information. For the moment thank you very much for your help! 🙏