following texts of firsts "]." of items 0 of
(
variables whose
(
it starts with "[tcpout:"
)
of it, unique values of following texts of firsts "[tcpout].defaultGroup=" of variables whose
(
it starts with "[tcpout].defaultGroup="
)
of it
)
whose
(
item 0 of it starts with
(
"[tcpout:" & item 1 of it & "]"
)
)
of files "outputs.conf" of folders "etc\system\local" of
(
folder it
)
of
(
it as string as trimmed string
)
of values "InstallLocation" of keys whose
(
exists values "DisplayName" whose
(
it as string contains "UniversalForwarder"
)
of it AND exists values whose
(
it as string as lowercase contains "splunk"
)
of it
)
of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of
(
x64 registries; x32 registries
)
following texts of firsts "]." of items 0 of ( variables whose(it starts with "[tcpout:") of it, unique values of following texts of firsts "[tcpout].defaultGroup=" of variables whose(it starts with "[tcpout].defaultGroup=") of it ) whose(item 0 of it starts with ("[tcpout:" & item 1 of it & "]")) of files "outputs.conf" of folders "etc\system\local" of (folder it) of (it as string as trimmed string) of values "InstallLocation" of keys whose(exists values "DisplayName" whose(it as string contains "UniversalForwarder") of it AND exists values whose(it as string as lowercase contains "splunk") of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x64 registries; x32 registries)
