topic Re: Search hosts, Windows updates in Splunk Search

Search hosts, Windows updates

ivan123357 — Mon, 09 Nov 2020 17:08:43 GMT

Hello! I am new in Splunk Search.

I am using this query to find all hosts to which a specific update was installed:

source="WinEventLog:System" | search "KB4579311" | stats last(Keywords) as lastStatus by _time, host | search lastStatus="Installation, Failure”

But I need a query to find all hosts and create a table with hosts to which this update wasn't installed. It turns out that I need to display all hosts that were not found in the request above. Need help with it. Thank you!

Re: Search hosts, Windows updates

richgalloway — Mon, 09 Nov 2020 18:15:59 GMT

Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

Re: Search hosts, Windows updates

ivan123357 — Mon, 09 Nov 2020 18:24:28 GMT

Thank you for your answer!

If think logically, then I need to display hosts in the logs of which a certain number of updates is NOT found, which I indicate in the search. For example:

source="WinEventLog:System" EventCode=19 | stats by host |where NOT like(Message, " Update_Number"). But this search shows all events without this string(update number) but I need only a list of hosts.

Re: Search hosts, Windows updates

isoutamo — Mon, 09 Nov 2020 19:29:20 GMT

Hi
I think this should work
- get list of all your wndows hosts to lookup (e.g. once a week)
- query hosts which have this fix applied
- use previous lookup within above query to get list of nodes which haven’t this fix installed.
There is quite many examples how this could do.
r. Ismo

Re: Search hosts, Windows updates

ivan123357 — Mon, 09 Nov 2020 19:51:22 GMT

Hello!

Sounds great. I will try it now.

Can you give me an example too or a URL to documentation? It would be cool if I had a fewexamples

Re: Search hosts, Windows updates

isoutamo — Mon, 09 Nov 2020 20:16:52 GMT

This is one version of your challenge https://community.splunk.com/t5/Getting-Data-In/How-to-create-an-alert-for-the-host-not-sending-data-for-an-hour/m-p/407769
r. Ismo

Re: Search hosts, Windows updates

ivan123357 — Tue, 10 Nov 2020 09:32:40 GMT

I tried this way but I didn't receive any result. I am a newbie in Splunk 😞

What do you think about this way?:

I can search all events with a successful update using regex search

source="WinEventLog:System" | regex Message = "KB5555555" and for example i receive a few events from two hosts. First question: How I can create a table with a list of these hosts?

As I guess, then I can't use a search like "source="WinEventLog:System" | regex not Message = "KB5555555"" to find all hosts without this update because this search won't show any events.

I'm stumped 😞