Installation

How to filter down events with specific string value from a multivalue field and then to compare and pick values as per the condition?

sureshmurgan
Path Finder

Windows update installation logs from machines are forwarded every day in Splunk.
In our windows environment, some windows update installations might fail and get logged as failed in the log, many get installed and gets logged as installed. These failed updates will try again to install another time and may get installed successfully or may end up as a failure again.

Requirement: Take all the values from the installation logs (ie., all the values in a field) filter out the failed installation which hasn't been able to get installed successfully yet.

Labels (1)
0 Karma
1 Solution

sureshmurgan
Path Finder

index=windowsevents sourcetype="System" SourceName=WindowsUpdate

           EventCode=19 OR EventCode=20

           |rex field=Message "(?P<Status>Installation\s\w+):.*(?P<Update>KB\d+).*"


           |stats latest(_time) as Time latest(Status) as Status latest(Message) as Message by host Update
           |search Status="Installation Failure"

View solution in original post

0 Karma

sureshmurgan
Path Finder

index=windowsevents sourcetype="System" SourceName=WindowsUpdate

           EventCode=19 OR EventCode=20

           |rex field=Message "(?P<Status>Installation\s\w+):.*(?P<Update>KB\d+).*"


           |stats latest(_time) as Time latest(Status) as Status latest(Message) as Message by host Update
           |search Status="Installation Failure"
0 Karma

sureshmurgan
Path Finder

Here's the query that's written till now. This will fetch all the Installation success and failure events and going to give the latest result. There could be multiple updates and some might have failed and other updates that came through would have got installed fine. So, this query is only going to give me the latest log where its failure. I need to get all the installation failure logs with the respective updates.
Not sure if this is this clear enough?

index=sccm_uk source="C:\Windows\CCM\Logs\WUAHandler.log" sourcetype=WindowsCCMLogs host="*" (ADSite_Membership="Installation job encountered some failures") OR
(ADSite_Membership="Installation of updates completed.")

           |stats latest(ADSite_Membership) as WUAInstallError by host
           |search WUAInstallError!="Installation of updates completed."                 
           |dedup host
           |stats dc(host) as #Hosts by WUAInstallError
           |sort 0 - #Hosts
           |addcoltotals #Hosts
0 Karma

sureshmurgan
Path Finder

I got the solution. I am using windows events to keep a track of the installation failure and got a query working for it. Thanks!

0 Karma

VatsalJagani
Champion

If you can, please share your solution as an answer here and accept it.

0 Karma

sureshmurgan
Path Finder

index=windowsevents sourcetype="System" SourceName=WindowsUpdate

              EventCode=19 OR EventCode=20

              |rex field=Message "(?P<Status>Installation\s\w+):.*(?P<Update>KB\d+).*"


              |stats latest(_time) as Time latest(Status) as Status latest(Message) as Message by host Update
              |search Status="Installation Failure"
0 Karma

sureshmurgan
Path Finder

This gives me the intended result. Thanks VatsalJagani for your help with this.

0 Karma

VatsalJagani
Champion

@sureshmurgan - Could you please share _raw event sample and query that till now you have wrote if any?

0 Karma

sureshmurgan
Path Finder

Hi Vatsal, thanks for responding.
Here's the query that's written till now. This will fetch all the Installation success and failure events and going to give the latest result. There could be multiple updates and some might have failed and other updates that came through would have got installed fine. So, this query is only going to give me the latest log where its failure. I need to get all the installation failure logs with the respective updates.
Not sure if this is this clear enough?

index=sccm_uk source="C:\Windows\CCM\Logs\WUAHandler.log" sourcetype=WindowsCCMLogs host="" (ADSite_Membership="Installation job encountered some failures") OR
(ADSite_Membership="Installation of updates completed.")

              |stats latest(ADSite_Membership) as WUAInstallError by host
              |search WUAInstallError!="Installation of updates completed."                 
              |dedup host
              |stats dc(host) as #Hosts by WUAInstallError
              |sort 0 - #Hosts
              |addcoltotals #Hosts
0 Karma

VatsalJagani
Champion

Could you please try:

index=sccm_uk source="C:\\Windows\\CCM\\Logs\\WUAHandler.log" sourcetype=WindowsCCMLogs host="" (ADSite_Membership="Installation job encountered some failures") OR 
(ADSite_Membership="Installation of updates completed.")
|stats list(ADSite_Membership) as WUAInstall by host

Could you please check value of WUAInstall? Is this what you want? It must be showing all logs(ADSite_Membership) of installation.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...