How to search which hosts are missing patches using a lookup with a list of patches that should be installed for each hostname?

[ArsenyKapralov]

Hi

I have a list of events about patches installed on my hosts (about 3k) which look like

Hostname1, PatchId1
Hostname1, PatchId2
Hostname2, PatchId2
Hostname2, PatchId3

Also I have lookup with list of patches which should be installed on each hostname.
I know that some are hosts missing some patches and I need to find which hosts are missing which patches.

Please help me to understand a way how to do this.

[jeffland]

Simple - do an inputlookup of your csv and NOT that with the search that produces your list of installed patches. That should give you the entries which are in the csv but not in the data of your index.

It should look something along the lines of

| inputlookup your_csv NOT [search your_search | table name, patch]

Try the subsearch alone with a | format at the end to see how the result is passed to the NOT of the inputlookup - it's a simple ((name=x AND patch=y) OR (name=a AND patch=b) ... ), which is exactly what you want for your NOT.

Of course this only works if the column names are the same in your csv and the search, but that can easily be done with a rename if neccessary.

[ArsenyKapralov]

Thank you

But I think this search will only find first match and it will not show correct results for thousand of hosts for each one. How can I do this?

[jeffland]

Have you tried switching the main and the subsearch then?