Splunk Search

How to create a list of servers with applications missing on a server

ADPSTT
New Member

Hello!

On a server we need to have X mandatory applications insalled.
I would like to create a list of servers with applications missing on a server but I don't know how to do it.

For example:
When I want the list of servers where VMWARE Tools is installed:

index=windows sourcetype=Script:InstalledApps host=*  | search DisplayName="VMware Tools" | table host

I would like a list of servers where VMWARE Tools is missing but I don't find how to.

Someone can help me about that? please

Thank you!

Regards,
Stephane

0 Karma

MOberschelp
Explorer

Short question: How do you get the data for Script:InstalledApps in?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

How about something like this?

index=windows sourcetype=Script:InstalledApps host=* NOT DisplayName="VMware Tools" | stats values(host) AS host

0 Karma

Grumpalot
Communicator

@ADPSTT using this search index=windows sourcetype=Script:InstalledApps host=* | search DisplayName="VMware Tools" | table host would get you all servers with "VMWare Tools" the string would match exactly that installed.

One thing to verify is that the DisplayName is exactly "VMWare Tools" if its not then you can use Wild Cards "VMWare Tools*" or something like that to match multiple different names for the tools ex "VMWare Tools version 6.4". If you were to use the following search you would also get those results dropping the first pipe, since you can remove more events/servers right off the bat and not have to store those for the next pipe

index=windows sourcetype=Script:InstalledApps DisplayName="VMware Tools*" | table host

if you have multiple entrys for the same server then you can do a dedup before the host your search | dedup host | table host

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!