Splunk Dev

Script:InstalledApps Compare Multiple Machines

bnickel
New Member

I am trying to see if it is possible to have Splunk show Application/Patch differences between multiple machines. Essentially I have a group of machines that should be on the same version for applications and patches. Currently I have a search that will show a table with the latest version for one computer:

index=* host=ComputerName sourcetype="Script:InstalledApps"
| stats latest(DisplayVersion) as DisplayVersion by DisplayName

This is just for one computer, is there a way to have one machine be the "Master" which would have everything up to date and have Splunk show a list of machines that do not match the "Master"?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index=* host=* ***(try to put specific index/sourcetype/source in base search)***
 | stats latest(DisplayVersion) as DisplayVersion by host DisplayName
 | eval MasterVersion=if(host="MasterHostName",DisplayVersion,null())
| eventstats values(MasterVersion) as MasterVersion by DisplayVersion
| where host!="MasterHostName"
| eval Status=if(DisplayVersion=MasterVersion,"Up-to-date","Do not match")

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

index=* host=* ***(try to put specific index/sourcetype/source in base search)***
 | stats latest(DisplayVersion) as DisplayVersion by host DisplayName
 | eval MasterVersion=if(host="MasterHostName",DisplayVersion,null())
| eventstats values(MasterVersion) as MasterVersion by DisplayVersion
| where host!="MasterHostName"
| eval Status=if(DisplayVersion=MasterVersion,"Up-to-date","Do not match")
0 Karma

bnickel
New Member

Thank you! This has helped tremendously, just need a little time to tinker/test with this Search.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...