I am trying to run a search to locate specific missing software. I'm hitting a roadblock. I don't want to have to pull all software and do an extraction. I just want to be able to see what devices are missing our AV applications. Any thoughts?
Thanks.
As @richgalloway said, you cannot look for some that's not there
However, you can look for things that are some places and not others
You might do something like this on a periodic basis (of course, use whatever field names fit your environment):
index=ndx sourcetype=srctp hostname=* appname=*
| stats count by hostname
| fields - count
| outputlookup allendpointswithsoftware.csv
Now you have a list of all endpoints that have installed software of any kind.
Now get a list of all endpoints that have the AV software:
index=ndx sourcetype=srctp hostname=* appname="my-AV-name"
| stats count by hostname
| fields - count
| outputlookup allendpointswithavtools.csv
Then do a diff between them:
| inputlookup allendpointswithsoftware.csv
| search NOT
[ | inputlookup allendpointswithavtools.csv ]
This will give you all the hosts that weren't in the AV-is-installed list, but are known in Splunk
As @richgalloway said, you cannot look for some that's not there
However, you can look for things that are some places and not others
You might do something like this on a periodic basis (of course, use whatever field names fit your environment):
index=ndx sourcetype=srctp hostname=* appname=*
| stats count by hostname
| fields - count
| outputlookup allendpointswithsoftware.csv
Now you have a list of all endpoints that have installed software of any kind.
Now get a list of all endpoints that have the AV software:
index=ndx sourcetype=srctp hostname=* appname="my-AV-name"
| stats count by hostname
| fields - count
| outputlookup allendpointswithavtools.csv
Then do a diff between them:
| inputlookup allendpointswithsoftware.csv
| search NOT
[ | inputlookup allendpointswithavtools.csv ]
This will give you all the hosts that weren't in the AV-is-installed list, but are known in Splunk
You can't search for something that's not there. See https://www.duanewaddle.com/proving-a-negative/
The only way to find who doesn't have something is to subtract those that do have it from the list of everyone.