What search string would I use to find out what computers do NOT have a specific software. I have the Splunk TA Windows add on working and pulling in all the information from my universal forwarders. I can easily find all the computers that do have a specific software installed, but only care about those that don't have it. Below is some information that we are indexing that could maybe help to find the results. I want to know what computers do NOT have SentinelOne.
2019-12-17 14:42:02.668
Installed application enumerated from "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sentinel Agent"
DisplayName="Sentinel Agent"
ApplicationVersion=3.1.4.50
Publisher=SentinelOne
DisplayIcon=C:\Program Files\SentinelOne\Sentinel Agent 3.1.4.50\uninstall.exe
DisplayVersion=3.1.4.50
URLInfoAbout=http://www.sentinelone.com/support/
Contact=support@sentinelone.com
InstallDate=20190731
UninstallString="C:\Program Files\SentinelOne\Sentinel Agent 3.1.4.50\uninstall.exe" /uninstall
... View more