Splunk Search

returning values that dont exist

johnrbhancock
Engager

I have two queries. I have enabled the installed software script in splunk so I can determine where software is not installed on a windows server. How do I run a query to return all hosts that do not have specific software installed. The not function seems to only return items in a table. for example I have operations manager installed on serverx but not serverb how do I query all the servers to return server b.

 

The second query I have is: I have pulled in two csv data sources. The first list is our CMDB server list (call it A) and the second list is an extract of servers that have agents installed (call it B). I would like to compare the two lists and return the hosts that are in list A but not in list B. The two liosts are in the same index and have the same field name (Name) for servername.  

Labels (3)
0 Karma

lekanneer
Loves-to-Learn Lots

This is why I developed a solution to overcome the problem of lookups and/or indexes. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need.

I wrote a post about that recently: SOCs: why they struggle with context 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I am not sure I understand the first part as I don't know that script you've installed.

However, for part 2 you can do something like this example you can paste into the search window

| makeresults
| eval A=split("a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z", ",")
| eval B=split("a,c,d,h,i,k,l,m,n,o,p,r,s,u,v,x,y", ",")
| stats values(B) as B by A
| where isnull(mvfind(B,A))
| stats values(A)

 So collect all your CMDB servers to A and servers with agents as B, then the last 3 lines will generate a list of all 'servers with agents installed' and have that as a value for all items A.

Then the mvfind will filter out all present items and the last line shows all items missing

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...