topic Re: Finding out which users have certain software installed in Installation

Finding out which users have certain software installed

lewis_c26 — Mon, 13 Jan 2020 10:20:32 GMT

I have been set a task at work to find out:
Which users have certain bits of software installed on their machine and have access to it, for licensing reason.
is there a simple search that can be done that creates a .csv file in the end that i can send t the manager.
Also needs to be able to be done with other bits of software.

Excuse the lack of knowledge i am new to Splunk and still leaning my way around.

Re: Finding out which users have certain software installed

kamlesh_vaghela — Mon, 13 Jan 2020 12:40:02 GMT

@lewis_c26

Can you please share more details about events you are collecting from user's machine?? Like sample events, OR any App/TA you are using for data collection.

Re: Finding out which users have certain software installed

lewis_c26 — Mon, 13 Jan 2020 14:09:50 GMT

@kamlesh_vaghela

The Computer Name (Hostname), IP Address, User who is currently logged on, IP Address, Manufacturer, MAC Address, the domain and then the installed software and updates. All of this is collected using the Universal Forwarder and displayed on a handy dashboard. I believe there is more data and events collected but the above is what i am aware of.
Thanks for the help.

Re: Finding out which users have certain software installed

wmyersas — Mon, 13 Jan 2020 22:10:01 GMT

If you already have it on a dashboard, just export the dashboard's results into a CSV

Alternatively, open the dashboard panel in search, make and tweaks/changes, and then export those results in a CSV

Re: Finding out which users have certain software installed

MuS — Tue, 14 Jan 2020 00:41:33 GMT

Or take that search save it as scheduled report and send it directly to your manager, no manual actions needed 😉

cheers, MuS

Re: Finding out which users have certain software installed

lewis_c26 — Tue, 14 Jan 2020 09:10:57 GMT

Is it possible to give some more details on what search i could do to get the data on who has what software before generating the report to send to the user?

Re: Finding out which users have certain software installed

wmyersas — Tue, 14 Jan 2020 14:36:40 GMT

What are you actually trying to accomplish?

A per user report (to distribute to each user)?

What's on the dashboard you currently have?

Re: Finding out which users have certain software installed

dglass0215 — Tue, 14 Jan 2020 15:51:18 GMT

Take a look at the splunk add on for windows app (https://docs.splunk.com/Documentation/WindowsAddOn/7.0.0/User/SourcetypesandCIMdatamodelinfo) if you are not already using it. This has a sourcetype - Script:InstalledApps which will index all the installed applications.

Re: Finding out which users have certain software installed

lewis_c26 — Thu, 16 Jan 2020 09:01:01 GMT

I need to be able to give the business system manager a list of users that have visio installed on their machine and be able to replicate that for any other bits of software that need to be tightly controlled. The current dashboard from the Universal Forwarder shows: The hostname, the user, the OS, the manufacturer, model and the IP address. When you click on a computer name it does a search that shows a list of hat software is installed. The problem of trying to export it as a .csv file is it exports the list of software into one cell on excel and is a mess to read. It also displayed the all of the software whereas i am trying to get a list of which computers have a certain bit of software installed.

Re: Finding out which users have certain software installed

lewis_c26 — Thu, 16 Jan 2020 12:00:08 GMT

@dglass0215 Is there a feature/search so that you can search for a specific application installed on all of the computers? Thank you

Re: Finding out which users have certain software installed

dglass0215 — Thu, 16 Jan 2020 15:00:46 GMT

You can use the field named "DisplayName". Something like this:

sourcetype="Script:InstalledApps" DisplayName="\"McAfee*"\"

Re: Finding out which users have certain software installed

lewis_c26 — Thu, 16 Jan 2020 15:09:09 GMT

I am doing this search:
index=windows sourcetype="Script:InstalledApps" DisplayName="Microsoft Visio Viewer 2013"
| fields host,DisplayName
| dedup host, DisplayName | eval
| fields host,DisplayName,UserName |stats values(DisplayName) AS Applications by host Last_Seen

And i get this error;
Error in 'eval' command: Arguments are missing. Usage: eval dest_key = expression.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

Could you advise?

Re: Finding out which users have certain software installed

wmyersas — Thu, 16 Jan 2020 15:15:01 GMT

your eval isn't eval'ing anything

try

index=windows sourcetype="Script:InstalledApps" DisplayName="Microsoft Visio Viewer 2013"
| stats values(DisplayName) as Applications by host Last_Seen

Re: Finding out which users have certain software installed

lewis_c26 — Thu, 16 Jan 2020 15:18:57 GMT

i tried that, i forgot to add the host=* so that it also displays the host name of the computer

index=windows sourcetype="Script:InstalledApps" DisplayName="Microsoft Visio Viewer 2013" host=*
| stats values(DisplayName) as Applications by host Last_Seen

This still didn't work, there is no error; just no events found despite this software being installed on at least 50 machines

Re: Finding out which users have certain software installed

dglass0215 — Thu, 16 Jan 2020 15:27:02 GMT

Do you have events if you just search sourcetype="Script:InstalledApps"

Re: Finding out which users have certain software installed

lewis_c26 — Thu, 16 Jan 2020 15:27:50 GMT

Yes it displayed all of the installed software

Re: Finding out which users have certain software installed

wmyersas — Thu, 16 Jan 2020 15:29:57 GMT

is DisplayName is multivalue field?

If so, you may have some issues

try | stats count by DisplayName host Last_Seen maybe

Re: Finding out which users have certain software installed

dglass0215 — Thu, 16 Jan 2020 15:30:12 GMT

oh... for DisplayName you need DisplayName="\"Microsoft Visio Viewer 2013"\"

Re: Finding out which users have certain software installed

lewis_c26 — Thu, 16 Jan 2020 15:36:07 GMT

@wmyersas i dont know what a multivalue field is in Splunk as i am still new to it

@dglass0215 i have run the search;
index=windows sourcetype="Script:InstalledApps" DisplayName="\"Microsoft Visio Viewer 2013"\"
| stats values(DisplayName) as Applications by host Last_Seen
and it still is not displaying the list of computers with that installed.

Re: Finding out which users have certain software installed

dglass0215 — Thu, 16 Jan 2020 15:41:24 GMT

When you run a query and do not get any results, you need to lessen the criteria until you do to help figure out where the problem is.

For example: Do you get data if you search sourcetype="Script:InstalledApps" DisplayName="\"Microsoft Visio Viewer 2013"\"