returning values that dont exist

[johnrbhancock]

I have two queries. I have enabled the installed software script in splunk so I can determine where software is not installed on a windows server. How do I run a query to return all hosts that do not have specific software installed. The not function seems to only return items in a table. for example I have operations manager installed on serverx but not serverb how do I query all the servers to return server b.

The second query I have is: I have pulled in two csv data sources. The first list is our CMDB server list (call it A) and the second list is an extract of servers that have agents installed (call it B). I would like to compare the two lists and return the hosts that are in list A but not in list B. The two liosts are in the same index and have the same field name (Name) for servername.  

[lekanneer]

This is why I developed a solution to overcome the problem of lookups and/or indexes. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need.

I wrote a post about that recently: SOCs: why they struggle with context 

[bowesmana]

I am not sure I understand the first part as I don't know that script you've installed.

However, for part 2 you can do something like this example you can paste into the search window

| makeresults
| eval A=split("a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z", ",")
| eval B=split("a,c,d,h,i,k,l,m,n,o,p,r,s,u,v,x,y", ",")
| stats values(B) as B by A
| where isnull(mvfind(B,A))
| stats values(A)

 So collect all your CMDB servers to A and servers with agents as B, then the last 3 lines will generate a list of all 'servers with agents installed' and have that as a value for all items A.

Then the mvfind will filter out all present items and the last line shows all items missing