Search for a list of installed packages with version numbers for a host

[yrb6924]

I've managed to create a search which will list for me all installed packages on a particular host, but I need to have a list of packages with the version number. Any idea how I can modify/improve this search to give me this?

host=[hostname] sourcetype=package | multikv noheader=t | rex "(?\S+)" | stats dc(host) as dc by package | eventstats max(dc) as max | where dc = max | table package

[marklaw2]

Here's what I use to pull all software installed on Linux machines.

A different type of output show hosts and installed software:

sourcetype=package index=os
| multikv noheader=t
| rex field=_raw "^(?P[^ ]+)\s+(?P[^ ]+)\s+(?P[^ ]+)\s+(?P\w+)"
| search NOT NAME NOT VERSION NOT RELEASE NOT ARCH
| dedup host package version release arch
|table host package version release arch

[yrb6924]

In fact what I need is even easier:

index=os host="[hostname]*" sourcetype=package | dedup host

[dmaislin_splunk]

If you have a version field then modify your search. Notice that I also sorted it in descending order and only display top 10.

host=[hostname] sourcetype=package | multikv noheader=t | rex "(?<package>S+)" | stats dc(host) as dc by package,version | sort - dc | head 10