topic How do I search for Windows Servers Version (2008, 2012 etc)? in Splunk Search

How do I search for Windows Servers Version (2008, 2012 etc)?

etorres — Fri, 05 Aug 2022 20:26:06 GMT

Splunk Noob here. How do I search for Windows Servers Version (2008, 2012 etc)? Can this be done?

Re: Find Windows Servers

martinpu — Fri, 05 Aug 2022 20:25:40 GMT

It depends on what you are logging. If you search for 2008 or 2012 do you find any matches from your windows logs?
If you match the OS version from the logs then you can extract that as a field.

Re: How do I search for Windows Servers Version (2008, 2012 etc)?

gcusello — Sun, 07 Aug 2022 15:34:35 GMT

Hi @etorres,

I suppose that you're using the Splunk_TA_Windows to take logs from your Windows Servers, if this is true. you have to enable the first Host Monitoring Stanza

[WinHostMon://Computer] interval = 600 disabled = 0 type = Computer

to have the information about OS.

Otherwise you can have these information from the Deployment Server.

Ciao.

Giuseppe