How to write a search for a list of all different versions of an app?

[Mat1]

I'm not so keen in creating Splunk query, so I would kindly ask your support for the following query:

I need to have a list with all different versions of an application currently installed on all PC's and related username, hostname and src ip. My draft query is the following:

index=* sourcetype=* "pippo app"
| stats list(file_name) as "application" by src_user
| table username, hostname, src_ip, application with version

Thank you in advance.

[gcusello]

Hi @Mat1 ,

what's the issue you experienced: no results or results different from expected,

if the second, could you share the result you have and the result you want?

at first after a stats command you have only the fields in the command, in your case, you have only "src_user" and "application".

If this is your issue, you have to add the other fields in the stats options using the values option.

Then, if you run only the main search, have you in interesting fields src_user and file_name?

if yse, check if in the same event you have both these fields abd check filenames.

Ciao.

Giuseppe

[Mat1]

Hi @gcusello ,

my previous query didn't give any results, because was wrong. This is my new query:

index=*   "KeePass"
| table src_user, src_user_email, src_ip, file_name | dedup src_user

I need my query to show me the 'keepass' application and its version on each PC.
With this query it only finds me the .exe, .dll, etc. files, but I need to know the version installed on each PC.
Right now it correctly shows me "username", "password" and "IP" (although not everything, because I think there is some info missing in the raw file).

[gcusello]

Hi @Mat1 ,

where is stored the information about version?

if you haven't this information see if it's possible to extract it using a script.

Ciao.

Giuseppe

[Mat1]

Hi @gcusello ,

ok, I'll try to get this information. For the moment thank you very much for your help! 🙏

[richgalloway]

What's wrong with the query you have?  What does your data look like?

[Mat1]

My query doesn't work