Splunk Search

How to search which hosts are missing patches using a lookup with a list of patches that should be installed for each hostname?

ArsenyKapralov
Path Finder

Hi

I have a list of events about patches installed on my hosts (about 3k) which look like

Hostname1, PatchId1
Hostname1, PatchId2
Hostname2, PatchId2
Hostname2, PatchId3

Also I have lookup with list of patches which should be installed on each hostname.
I know that some are hosts missing some patches and I need to find which hosts are missing which patches.

Please help me to understand a way how to do this.

Tags (2)
0 Karma

jeffland
SplunkTrust
SplunkTrust

Simple - do an inputlookup of your csv and NOT that with the search that produces your list of installed patches. That should give you the entries which are in the csv but not in the data of your index.

It should look something along the lines of

| inputlookup your_csv NOT [search your_search | table name, patch]

Try the subsearch alone with a | format at the end to see how the result is passed to the NOT of the inputlookup - it's a simple ((name=x AND patch=y) OR (name=a AND patch=b) ... ), which is exactly what you want for your NOT.

Of course this only works if the column names are the same in your csv and the search, but that can easily be done with a rename if neccessary.

0 Karma

ArsenyKapralov
Path Finder

Thank you

But I think this search will only find first match and it will not show correct results for thousand of hosts for each one. How can I do this?

0 Karma

jeffland
SplunkTrust
SplunkTrust

Have you tried switching the main and the subsearch then?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...