Splunk Enterprise Security

Monitor Unsuccessful Windows Updates

test_qweqwe
Builder

How to change this search to show Unsuccessful/Failed Windows Updates?
sourcetype=WinEventLog:System EventCode=19 | eval Date=strftime(_time, "%Y/%m/%d") | rex "\WKB(?.\d+)\W" | eval successRatio=mvindex(split(Keywords,","),-1) | stats count by Date , host, package_title, KB , body , successRatio| sort host

0 Karma
1 Solution

elliotproebstel
Champion

I think your field extractions are different from mine, but I'll take a stab here. You definitely have an issue with the rex command, because that's not proper syntax. Give this a shot:

rex field=Message "\WKB(?<KB>\d+)\W"

If you still aren't getting the results you expect, try removing the | stats count... portion of the search and ensure that all of the fields you specify are present: Date, host, package_title, KB, body, and successRatio.

View solution in original post

elliotproebstel
Champion

I think your field extractions are different from mine, but I'll take a stab here. You definitely have an issue with the rex command, because that's not proper syntax. Give this a shot:

rex field=Message "\WKB(?<KB>\d+)\W"

If you still aren't getting the results you expect, try removing the | stats count... portion of the search and ensure that all of the fields you specify are present: Date, host, package_title, KB, body, and successRatio.

test_qweqwe
Builder

index=* (sourcetype="*WinEventLog:System" OR sourcetype="WindowsUpdateLog") (KB*) | stats latest(status) as lastStatus by _time, dest, signature, signature_id | search lastStatus=failure

This working

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...