Splunk Enterprise

How to write a search for a list of all different versions of an app?

Mat1
Explorer

I'm not so keen in creating Splunk query, so I would kindly ask your support for the following query:

I need to have a list with all different versions of an application currently installed on all PC's and related username, hostname and src ip. My draft query is the following:

index=* sourcetype=* "pippo app"
| stats list(file_name) as "application" by src_user
| table username, hostname, src_ip, application with version

Thank you in advance.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mat1 ,

what's the issue you experienced: no results or results different from expected,

if the second, could you share the result you have and the result you want?

at first after a stats command you have only the fields in the command, in your case, you have only "src_user" and "application".

If this is your issue, you have to add the other fields in the stats options using the values option.

Then, if you run only the main search, have you in interesting fields src_user and file_name?

if yse, check if in the same event you have both these fields abd check filenames.

Ciao.

Giuseppe

Mat1
Explorer

Hi @gcusello ,

my previous query didn't give any results, because was wrong. This is my new query:

index=*   "KeePass"
| table src_user, src_user_email, src_ip, file_name | dedup src_user

I need my query to show me the 'keepass' application and its version on each PC.
With this query it only finds me the .exe, .dll, etc. files, but I need to know the version installed on each PC.
Right now it correctly shows me "username", "password" and "IP" (although not everything, because I think there is some info missing in the raw file).

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mat1 ,

where is stored the information about version?

if you haven't this information see if it's possible to extract it using a script.

Ciao.

Giuseppe

Mat1
Explorer

Hi @gcusello ,

ok, I'll try to get this information. For the moment thank you very much for your help! 🙏

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What's wrong with the query you have?  What does your data look like?

---
If this reply helps you, Karma would be appreciated.

Mat1
Explorer

My query doesn't work

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...