Splunk Dev

Script:InstalledApps Compare Multiple Machines

bnickel
New Member

I am trying to see if it is possible to have Splunk show Application/Patch differences between multiple machines. Essentially I have a group of machines that should be on the same version for applications and patches. Currently I have a search that will show a table with the latest version for one computer:

index=* host=ComputerName sourcetype="Script:InstalledApps"
| stats latest(DisplayVersion) as DisplayVersion by DisplayName

This is just for one computer, is there a way to have one machine be the "Master" which would have everything up to date and have Splunk show a list of machines that do not match the "Master"?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index=* host=* ***(try to put specific index/sourcetype/source in base search)***
 | stats latest(DisplayVersion) as DisplayVersion by host DisplayName
 | eval MasterVersion=if(host="MasterHostName",DisplayVersion,null())
| eventstats values(MasterVersion) as MasterVersion by DisplayVersion
| where host!="MasterHostName"
| eval Status=if(DisplayVersion=MasterVersion,"Up-to-date","Do not match")

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

index=* host=* ***(try to put specific index/sourcetype/source in base search)***
 | stats latest(DisplayVersion) as DisplayVersion by host DisplayName
 | eval MasterVersion=if(host="MasterHostName",DisplayVersion,null())
| eventstats values(MasterVersion) as MasterVersion by DisplayVersion
| where host!="MasterHostName"
| eval Status=if(DisplayVersion=MasterVersion,"Up-to-date","Do not match")
0 Karma

bnickel
New Member

Thank you! This has helped tremendously, just need a little time to tinker/test with this Search.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...