Installation

Using Splunk to Determine Installed Software

kabobb
Explorer

I'm looking to see if there is a splunk app that will look at a host and list all the software installed on said host.

kabobb
Explorer

The systems are mostly Red Hat and Windows 08 and 12 boxes. Both red-hat and windows provide commands to list installed software packages.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can use the Universal Forwarder, at least for Windows. See \Program Files\SplunkUniversalForwarder\etc\apps\windows\bin\win_installed_apps.bat or /opt/splunkforwarder/etc/apps/unix/bin/package.sh. Note that the Windows script will only report installed software recorded in the Windows registry; other software (like putty) will not be reported.

---
If this reply helps you, Karma would be appreciated.

martin_mueller
SplunkTrust
SplunkTrust

That'll provide Splunk with a snapshot. Scripted inputs are configured to run after some interval, so you can run them often enough to provide constant monitoring.

0 Karma

kabobb
Explorer

Hi Rich,
Will running this batch file only give me a snapshot of the systems? Or will it provide me with ongoing status of what's installed on the systems? I'm looking for constant monitoring of installed software. I have both RH and Windows systems in my environment, but this is a step in the right direction so thanks for answering!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Do you have a means of getting such a list on your host, for example by running a command line tool?

Additionally, you'll get much more useful responses if you provide a little more info - OS for example.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...