Splunk ITSI

How to edit my compliance search to make any product version higher than the one in my lookup file be considered Compliant?

sandeepshah81
Explorer

I have a compliance search which I have created using a lookup file that does gives results. However, for a product version which is higher than the one I have in the Lookup file should be considered as Compliant, but it is being considered as Non-Compliant in the result.

I have a lookup file as csv format with below details
DisplayName DisplayVersion Status
Adobe Acrobat Reader DC 18.11.20040 Compliant

I am using a query like below where one of the Application Name is not actually the name of the Application, but it is a Plugin to the main application so I am excluding not be searched for (Extended Asian Language font pack for Adobe Acrobat Reader DC).

index=abc_aa sourcetype=xxxxxxxx OsVersion=10.0 host="*" (DisplayName="Adobe Acrobat Reader DC" AND DisplayName!="Extended Asian Language font pack for Adobe Acrobat Reader DC") | table  host DisplayName DisplayVersion OsVersion | lookup Coreapps.csv DisplayVersion OUTPUTNEW Status | eval Status=if((isnull(Status),"NonCompliant",Status)

I am able to get result with table command ...
but in the results: If I have a PC in which the Application version is greater than the one I have in my lookup file (18.11.20040 is in my lookup file), it takes that version as Non-Complaint which actually should not be the case as it is higher version.. I do not want to add that higher version in the lookup file.

Is there any other option to detect any version higher than or equal to the one I have selected is Compliant and lower then it is Non-Compliant?

How do I achieve it??

johnnyfrx
Path Finder

Maybe try a 'case' statement instead of 'if' and add another status type just called compliant for versions that are greater than the current version.

0 Karma

sandeepshah81
Explorer

Any comments from Anyone???

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...