topic Re: Using Splunk to Determine Installed Software in Installation

Using Splunk to Determine Installed Software

kabobb — Tue, 11 Mar 2014 19:44:26 GMT

I'm looking to see if there is a splunk app that will look at a host and list all the software installed on said host.

Re: Using Splunk to Determine Installed Software

martin_mueller — Tue, 11 Mar 2014 21:45:09 GMT

Do you have a means of getting such a list on your host, for example by running a command line tool?

Additionally, you'll get much more useful responses if you provide a little more info - OS for example.

Re: Using Splunk to Determine Installed Software

richgalloway — Mon, 28 Sep 2020 16:06:26 GMT

You can use the Universal Forwarder, at least for Windows. See \Program Files\SplunkUniversalForwarder\etc\apps\windows\bin\win_installed_apps.bat or /opt/splunkforwarder/etc/apps/unix/bin/package.sh. Note that the Windows script will only report installed software recorded in the Windows registry; other software (like putty) will not be reported.

Re: Using Splunk to Determine Installed Software

kabobb — Wed, 12 Mar 2014 14:29:00 GMT

The systems are mostly Red Hat and Windows 08 and 12 boxes. Both red-hat and windows provide commands to list installed software packages.

Re: Using Splunk to Determine Installed Software

kabobb — Wed, 12 Mar 2014 14:35:57 GMT

Hi Rich,
Will running this batch file only give me a snapshot of the systems? Or will it provide me with ongoing status of what's installed on the systems? I'm looking for constant monitoring of installed software. I have both RH and Windows systems in my environment, but this is a step in the right direction so thanks for answering!

Re: Using Splunk to Determine Installed Software

martin_mueller — Wed, 12 Mar 2014 14:40:14 GMT

That'll provide Splunk with a snapshot. Scripted inputs are configured to run after some interval, so you can run them often enough to provide constant monitoring.