Splunk Dev

Script:InstalledApps Compare Multiple Machines

bnickel
New Member

I am trying to see if it is possible to have Splunk show Application/Patch differences between multiple machines. Essentially I have a group of machines that should be on the same version for applications and patches. Currently I have a search that will show a table with the latest version for one computer:

index=* host=ComputerName sourcetype="Script:InstalledApps"
| stats latest(DisplayVersion) as DisplayVersion by DisplayName

This is just for one computer, is there a way to have one machine be the "Master" which would have everything up to date and have Splunk show a list of machines that do not match the "Master"?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index=* host=* ***(try to put specific index/sourcetype/source in base search)***
 | stats latest(DisplayVersion) as DisplayVersion by host DisplayName
 | eval MasterVersion=if(host="MasterHostName",DisplayVersion,null())
| eventstats values(MasterVersion) as MasterVersion by DisplayVersion
| where host!="MasterHostName"
| eval Status=if(DisplayVersion=MasterVersion,"Up-to-date","Do not match")

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

index=* host=* ***(try to put specific index/sourcetype/source in base search)***
 | stats latest(DisplayVersion) as DisplayVersion by host DisplayName
 | eval MasterVersion=if(host="MasterHostName",DisplayVersion,null())
| eventstats values(MasterVersion) as MasterVersion by DisplayVersion
| where host!="MasterHostName"
| eval Status=if(DisplayVersion=MasterVersion,"Up-to-date","Do not match")
0 Karma

bnickel
New Member

Thank you! This has helped tremendously, just need a little time to tinker/test with this Search.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...