How to create a list of servers with applications missing on a server

[ADPSTT]

Hello!

On a server we need to have X mandatory applications insalled.
I would like to create a list of servers with applications missing on a server but I don't know how to do it.

For example:
When I want the list of servers where VMWARE Tools is installed:

index=windows sourcetype=Script:InstalledApps host=*  | search DisplayName="VMware Tools" | table host

I would like a list of servers where VMWARE Tools is missing but I don't find how to.

Someone can help me about that? please

Thank you!

Regards,
Stephane

[MOberschelp]

Short question: How do you get the data for Script:InstalledApps in?

[skoelpin]

How about something like this?

index=windows sourcetype=Script:InstalledApps host=* NOT DisplayName="VMware Tools" | stats values(host) AS host

[Grumpalot]

@ADPSTT using this search index=windows sourcetype=Script:InstalledApps host=* | search DisplayName="VMware Tools" | table host would get you all servers with "VMWare Tools" the string would match exactly that installed.

One thing to verify is that the DisplayName is exactly "VMWare Tools" if its not then you can use Wild Cards "VMWare Tools*" or something like that to match multiple different names for the tools ex "VMWare Tools version 6.4". If you were to use the following search you would also get those results dropping the first pipe, since you can remove more events/servers right off the bat and not have to store those for the next pipe

index=windows sourcetype=Script:InstalledApps DisplayName="VMware Tools*" | table host

if you have multiple entrys for the same server then you can do a dedup before the host your search | dedup host | table host