topic Subsearch help - windows patching in Splunk Search

Subsearch help - windows patching

jbeckwith — Tue, 29 Sep 2020 08:00:37 GMT

Hi, I've managed to use a few subsearches in the past with pretty good success but this one is troubling myself and a colleague, our windows event logs are pipped into splunk, it would be great if we could use the following query to find any servers that have not been patched in the last 'x' days, here are the two searches that work independently;

Last 'x' days
index=winevent EventCode=19 Message="Installation Successful*"|transaction host|fields host
Specific time window
index=winevent EventCode=19 Message="Installation Successful*" earliest="09/01/2015:00:00:00" latest="10/16/2015:00:00:00"| transaction host | table host

The second search has a date time range in it, to generate a list of all servers that were patched in that window, (found this to be a good way of getting a list of servers that should have been patched). I tried to put them together to make this;

index=winevent host NOT [search index=winevent EventCode=19 Message="Installation Successful*"|transaction host|fields host] EventCode=19 Message="Installation Successful*" earliest="09/01/2015:00:00:00" latest="10/16/2015:00:00:00"| transaction host | table host

but it fails, any ideas where I'm going wrong

Re: Subsearch help - windows patching

jplumsdaine22 — Mon, 30 Nov 2015 16:08:43 GMT

Try

index=winevent EventCode=19 Message="Installation Successful*" NOT  [index=winevent EventCode=19 Message="Installation Successful*" earliest="09/01/2015:00:00:00" latest="10/16/2015:00:00:00"|dedup host | fields host] | dedup host | fields host

Re: Subsearch help - windows patching

jbeckwith — Mon, 30 Nov 2015 17:31:42 GMT

Ah dedup, thank you!

index=winevent EventCode=19 Message="Installation Successful*" earliest="09/01/2015:00:00:00" latest="10/30/2015:00:00:00" NOT [search index=winevent EventCode=19 Message="Installation Successful*"|dedup host | fields host] | dedup host | fields host | table host

Once I put the query the right way around it works a treat, got my list of servers that haven't been patched in that time window

Re: Subsearch help - windows patching

brooklynotss — Tue, 01 Dec 2015 05:25:18 GMT

If you're not already, recommend splunking the windowsupdate.log file too. Can do what you're looking for here as well as tell you how many patches are needed etc.

Re: Subsearch help - windows patching

jplumsdaine22 — Tue, 01 Dec 2015 12:40:43 GMT

No problem. Do you mind accepting the answer? To help future forum users 🙂

Cheers,