Solved: Re: Help with Splunk alert to identify software re...

radparik · ‎05-25-2021

Hello,

I am trying to figure out how to monitor for a successful removal/installation of a software in the environment (mainly MSI) using Splunk. Does anyone know how I can go about this?

richgalloway · ‎05-25-2021

I believe you want events 11707 (install) and 11724 (remove).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

radparik · ‎05-26-2021

Thank you!

richgalloway · ‎05-25-2021

I believe you want events 11707 (install) and 11724 (remove).

---
If this reply helps you, Karma would be appreciated.

Help with Splunk alert to identify software removal/installation

alert condition

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

ATTENTION: We’re Moving! (AGAIN!)

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation