Search to show mismatches in a version field

[TheJagoff]

Hello,

The table below are the results from a REST query that shows the installed Apps/TA's from various servers (4 in the example) at my site.

| rest /services/apps/local | search disabled=0 core=0| dedup title |table label title version| collect index=test sourcetype=apps:installed

The following search produces the table below with Version mismatches highlighted in red:

index=test sourcetype="apps:installed"
| fillnull value="None" version, title
| table host label title version |rename label AS AppName | sort AppNam

host	AppName	Label	Version
Server1	Add-on for VMware ESXi Logs	Splunk_TA_esxilogs	4.1.0
Server2	Add-on for VMware ESXi Logs	Splunk_TA_esxilogs	4.1.0
Server3	Add-on for VMware ESXi Logs	Splunk_TA_esxilogs	4.0.0
Server1	Add-on for VMware Metrics	Splunk_TA_vmware_inframon	4.1.0
Server1	Add-on for Virtual Center	Splunk_TA_vcenter	4.1.0
Server2	Add-on for Virtual Center	Splunk_TA_vcenter	4.1.0
Server3	Add-on for Virtual Center	Splunk_TA_vcenter	4.1.0
Server4	Add-on for Virtual Center	Splunk_TA_vcenter	4.1.0
Server1	Add-on for ontap	Splunk_TA_ontap	3.0.0
Server1	Ansible Monitoring & Diagnostics	Ansible_Splunk	1.2.2
Server1	Admin Authentication	all_adminauth	0.1.0
Server2	Admin Authentication	all_adminauth	0.1.0
Server3	Admin Authentication	all_adminauth	1.0.0
Server4	Admin Authentication	all_adminauth	1.0.0

There is no entry in the results for a server if the App/TA isn't installed.

What I am asking for help on is a search that will show the entries that are mismatched on the "Version" field based on the "AppName" field. The rows where all versions match with the AppName can be ignored.

Thank you.

[TheJagoff]

There's no target version. I am looking for versions, based on the AppName that basically don't "agree" with each other. If 2 of the 3 servers have an App (with the same name) and the versions are 4.1.0 on 2 of them and 4.0.0 on the other, then I would like to see that. If they all match on the AppName and Version, no need to see it.

Thanks

[PickleRick · Accepted solution]

Ok. So if you want to simply leave those results where there is more than one version for a given app you can do - for example - something like this:

| eventstats dc(version) as number_of_versions by AppName
| where number_of_versions>1

At the end you can also aggregate your results with

| stats values(host) by AppName Label version

If you prefer it presented this way.

[yuanliu]

This eventstats needs to be grouped by app

| eventstats dc(version) as number_of_versions by AppName
| where number_of_versions>1

[PickleRick]

Yes, missed that. Fixing.

[TheJagoff]

Perfect! Thank you both!

[PickleRick]

What do you mean by "mismatched" here? Your results don't show a "target" version.

You can find the version with the highest count. You could find the highest version number...