https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-servers-with-applications-missing-on-a/m-p/302284#M90960 <P>Hello! </P> <P>On a server we need to have X mandatory applications insalled. <BR /> I would like to create a list of servers with applications missing on a server but I don't know how to do it.</P> <P>For example:<BR /> When I want the list of servers where VMWARE Tools is installed:</P> <PRE><CODE>index=windows sourcetype=Script:InstalledApps host=* | search DisplayName="VMware Tools" | table host </CODE></PRE> <P>I would like a list of servers where VMWARE Tools is missing but I don't find how to.</P> <P>Someone can help me about that? please</P> <P>Thank you!</P> <P>Regards,<BR /> Stephane</P> Fri, 25 Aug 2017 23:03:23 GMT ADPSTT 2017-08-25T23:03:23Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-servers-with-applications-missing-on-a/m-p/302284#M90960 <P>Hello! </P> <P>On a server we need to have X mandatory applications insalled. <BR /> I would like to create a list of servers with applications missing on a server but I don't know how to do it.</P> <P>For example:<BR /> When I want the list of servers where VMWARE Tools is installed:</P> <PRE><CODE>index=windows sourcetype=Script:InstalledApps host=* | search DisplayName="VMware Tools" | table host </CODE></PRE> <P>I would like a list of servers where VMWARE Tools is missing but I don't find how to.</P> <P>Someone can help me about that? please</P> <P>Thank you!</P> <P>Regards,<BR /> Stephane</P> Fri, 25 Aug 2017 23:03:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-servers-with-applications-missing-on-a/m-p/302284#M90960 ADPSTT 2017-08-25T23:03:23Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-servers-with-applications-missing-on-a/m-p/302285#M90961 <P>@ADPSTT using this search <CODE>index=windows sourcetype=Script:InstalledApps host=* | search DisplayName="VMware Tools" | table host</CODE> would get you all servers with "VMWare Tools" the string would match exactly that installed.</P> <P>One thing to verify is that the DisplayName is exactly "VMWare Tools" if its not then you can use Wild Cards "VMWare Tools*" or something like that to match multiple different names for the tools ex "VMWare Tools version 6.4". If you were to use the following search you would also get those results dropping the first pipe, since you can remove more events/servers right off the bat and not have to store those for the next pipe </P> <P><CODE>index=windows sourcetype=Script:InstalledApps DisplayName="VMware Tools*" | table host</CODE></P> <P>if you have multiple entrys for the same server then you can do a dedup before the host <CODE>your search | dedup host | table host</CODE></P> Sat, 26 Aug 2017 00:39:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-servers-with-applications-missing-on-a/m-p/302285#M90961 Grumpalot 2017-08-26T00:39:37Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-servers-with-applications-missing-on-a/m-p/302286#M90962 <P>How about something like this?</P> <P><CODE>index=windows sourcetype=Script:InstalledApps host=* NOT DisplayName="VMware Tools" | stats values(host) AS host</CODE></P> Sat, 26 Aug 2017 00:40:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-servers-with-applications-missing-on-a/m-p/302286#M90962 skoelpin 2017-08-26T00:40:25Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-servers-with-applications-missing-on-a/m-p/302287#M90963 <P>Short question: How do you get the data for Script:InstalledApps in?</P> Fri, 13 Jul 2018 08:13:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-servers-with-applications-missing-on-a/m-p/302287#M90963 MOberschelp 2018-07-13T08:13:11Z