preceding text of last "\" of
(
value "InstallLocation" of
(
keys of
(
key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall" of native registry
)
)
whose
(
value "DisplayName" of it = "Universal Forwarder" and value "Publisher" of it="Splunk, Inc."
)
as string
)
| "not installed"
preceding text of last "\" of (value "InstallLocation" of (keys of (key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall" of native registry)) whose (value "DisplayName" of it = "Universal Forwarder" and value "Publisher" of it="Splunk, Inc.") as string) | "not installed"
