I am trying to see if it is possible to have Splunk show Application/Patch differences between multiple machines. Essentially I have a group of machines that should be on the same version for applications and patches. Currently I have a search that will show a table with the latest version for one computer: index=* host=ComputerName sourcetype="Script:InstalledApps" | stats latest(DisplayVersion) as DisplayVersion by DisplayName This is just for one computer, is there a way to have one machine be the "Master" which would have everything up to date and have Splunk show a list of machines that do not match the "Master"? ... View more