XQL query for host inventory with versions

[JustJulian]

Hi,

I need a XQL query which outputs all endpoints and installed versions of a specific application. I found a way to get all computers with the application installed, but no version of it:

 config case_sensitive = false
| dataset = host_inventory
| filter applications != null
| arrayexpand applications
| alter applications=json_extract(applications, "$.application_name")
| filter applications contains "google chrome"
| fields applications, host_name
| dedup host_name by asc host_name 

Just kind of similar to the Host Insights, which outputs the version of the application. Any help would be appreciated.

Thanks!

[aspatil · Accepted solution]

Hello @JustJulian ,

Here you go:
dataset = host_inventory
| filter applications != null
| arrayexpand applications
| alter applications=json_extract(applications, "$.application_name"), software_vendor = json_extract(applications, "$.vendor"), software_verion = json_extract(applications, "$.version")
| filter applications contains "google chrome"
| fields applications, host_name, software_vendor , software_verion
| dedup host_name by asc host_name

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.

[JustJulian]

Thank you, this works great!