Hello! I am new in Splunk Search.
I am using this query to find all hosts to which a specific update was installed:
source="WinEventLog:System" | search "KB4579311" | stats last(Keywords) as lastStatus by _time, host | search lastStatus="Installation, Failure”
But I need a query to find all hosts and create a table with hosts to which this update wasn't installed. It turns out that I need to display all hosts that were not found in the request above. Need help with it. Thank you!
Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.
Thank you for your answer!
If think logically, then I need to display hosts in the logs of which a certain number of updates is NOT found, which I indicate in the search. For example:
source="WinEventLog:System" EventCode=19 | stats by host |where NOT like(Message, " Update_Number"). But this search shows all events without this string(update number) but I need only a list of hosts.
I tried this way but I didn't receive any result. I am a newbie in Splunk 😞
What do you think about this way?:
I can search all events with a successful update using regex search
source="WinEventLog:System" | regex Message = "KB5555555" and for example i receive a few events from two hosts. First question: How I can create a table with a list of these hosts?
As I guess, then I can't use a search like "source="WinEventLog:System" | regex not Message = "KB5555555"" to find all hosts without this update because this search won't show any events.
I'm stumped 😞