topic Re: Outdated OS in Getting Data In

Outdated OS

SN1 — Wed, 21 May 2025 06:20:47 GMT

Where can i get list of all outdated OS for my dashboard. Is there a site or something

Re: Outdated OS

gcusello — Wed, 21 May 2025 06:53:12 GMT

Hi @SN1 ,

what do you mean with "outdated OS"?

then outdated respect what: Splunk or what else?

Could you better describe your requirement?

Ciao.

Giuseppe

Re: Outdated OS

livehybrid — Wed, 21 May 2025 08:33:14 GMT

Hi @SN1

If you're looking for Splunk versions and their support status then you can use the following:

index=_internal hostname=* os=* | stats first(fwdType) as fwdType, first(os) as os, first(version) as splunk_version by hostname | rex field=splunk_version "(?<version_minor>[0-9]+\.[0-9]+)" | append [| makeresults format=csv data="version_minor, eos_date 9.0,Jun 14 2024 9.1,Jun 28 2025 9.2,Jan 31 2026 9.3,Jul 24 2026 9.4,Dec 16 2026" | eval eos_unix=strptime(eos_date,"%b %d %Y") ] | stats values(hostname) as hosts, first(eos_date) as eos_date, first(eos_unix) as eos_unix by version_minor | eval support_status=IF(eos_unix>time(),"In Support","Out of Support") | fillnull eos_date value="Unknown" | where hosts!=""

However if you want the base OS then this might be a little tricker.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Outdated OS

isoutamo — Wed, 21 May 2025 09:11:01 GMT

Unfortunately there is no list ready to use.

But you could create it based on this https://docs.splunk.com/Documentation/Splunk/9.4.2/ReleaseNotes/Deprecatedfeatures#Platform_support_changes_in_version_9.4 unfortunately you must go through quite many release notes to get splunk version vs deprecated versions.

After that you could utilize @livehybrid 's query with some modifications to utilize your os-support.csv.

Then if you are needing this information also for UFs, you must remember that their support times are longer that core components!

Here is link to Splunk Core support times https://www.splunk.com/en_us/legal/splunk-software-support-policy.html#core and just after it you can see UF's support times which are longer e.g. UF 9.0 ends after 36 month instead of 24 months like core.

Re: Outdated OS

PickleRick — Wed, 21 May 2025 09:27:24 GMT

EMOREWORDS - What do you mean by "oudated OS"? Outdated OS where? Under Splunk components? Running Splunk UFs? Something else?

Remember that Splunk is _not_ an endpoint management system. You must have data in the first place to be able to find something in it. So it's a question for you whether you have the data about OS versions in the first place.

Re: Outdated OS

isoutamo — Wed, 21 May 2025 10:20:41 GMT

This is good point. After thinking this question probably means how to get lis into dashboard which nodes have OS which didn’t contains all latest patches etc?

Can you @SN1 confirm what you are meaning for “outdated os”?