Hi. I have a splunk table which tracks all the plugin version available to install for each plugin. Please note that each plugin can have multiple values. The idea is to alert when a new version becomes available for any of the plugins(latest entry). the search runs every 5 mins.
Kindly help.
By "splunk table", I assume you mean the results of a search as it appears in your screenshot. If this is the case, you can compare the current data to a previous time's data. The search below will retrieve the unique data from the previous five minutes but only if it is not present in the previous day outside that five minute window.
index=<your_index> sourcetype=<your_sourcetype> earliest=-5m latest=now
| table key Plugin_version Release
| search NOT
[ | search index=<your_index> sourcetype=<your_sourcetype> earliest=-1d latest=-5m
| table key Plugin_version Release ]
Hi @rsantkumar,
To solve your requirement, you could have two approaches:
extract all the versions of each product and check that every target host has the highest, or, in different words, that they have all the same version.
In this way you cannot check the alignment with the newest version but only that all the versions are aligned.
Otherwise, you could create a lookup containing the latest version of each product to verify and check if all the targets are aligned with this version.
Ciao.
Giuseppe