Splunk Search

How to search if Windows update was installed successfully or not on multiple servers?

idab
Path Finder

Hi guys,

I modified a search we found online to show us what updates were installed successfully or not. The problem is, it says a fail on Splunk, but when we check the servers and WSUS, it says the updates were successfully installed. What would be the best way to write the search to check if the it was a good or failed installation?

Here is the search :

sourcetype=WinEventLog:System EventCode=19  tag=update | eval Date=strftime(_time, "%Y/%m/%d") | rex "\WKB(?<KB>.\d+)\W" | eval successRatio = if (status==installed, "GOOD" , "FAILED") | stats count by Date , host, package_title, KB , body , successRatio| sort host

Looking forward to ideas or response on this.

Thanks guys.

0 Karma

somesoni2
Revered Legend

If you see the field "Keywords" in your logs, try something like this

index=main sourcetype=WinEventLog:System EventCode=19  | eval Date=strftime(_time, "%Y/%m/%d") | rex "\WKB(?<KB>.\d+)\W" | eval successRatio=mvindex(split(Keywords,","),-1) | stats count by Date , host, package_title, KB , body , successRatio| sort host

idab
Path Finder

Thanks for the feedback somesoni2,
This was nicely done ; but i noticed the keywords on my log shows only what was installed and not the failed updates.
Any idea on how to find or get the information regarding the updates that failed during installation on the host ? If only there was way to recreate the above search to check for unsuccessful updates?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...