Splunk App for Unix and Linux: Has anyone been able to extract package source fields with NAME, VERSION, RELEASE, ARCH, VENDOR and GROUP?

[Volto]

Hello,

I am trying to generate reports of what packages and versions are installed on our hosts.

The package source from the unix app is helpful, but doesn't extract the fields with NAME, VERSION, RELEASE, ARCH, VENDOR, and GROUP.

Has anyone been able to extract these fields?

Thanks.

[rsennett_splunk · Accepted solution]

Give this a shot:

index=os source=package|multikv|stats count by VENDOR

You should see all the fields available to you as soon as you add the multikv