https://community.splunk.com/t5/Splunk-Search/How-to-find-ITSI-old-and-current-version-from-splunk-logs/m-p/627816#M218129 <P>Are you on Splunk 9.X? If so you can do this ...</P><LI-CODE lang="markup">index=_configtracker sourcetype=splunk_configuration_change "data.path"="/opt/splunk/etc/system/local/migration.conf" | eval old = 'data.changes{}.properties{}.old_value' | eval new = 'data.changes{}.properties{}.new_value' | table host old new</LI-CODE> Fri, 20 Jan 2023 19:08:39 GMT fredclown 2023-01-20T19:08:39Z https://community.splunk.com/t5/Splunk-Search/How-to-find-ITSI-old-and-current-version-from-splunk-logs/m-p/627205#M217947 <P>I'm trying to create a dashboard to find the old version and new version of splunk from the logs&nbsp;<BR />but unable to find it.</P> Mon, 16 Jan 2023 05:49:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-ITSI-old-and-current-version-from-splunk-logs/m-p/627205#M217947 sjaitly 2023-01-16T05:49:54Z https://community.splunk.com/t5/Splunk-Search/How-to-find-ITSI-old-and-current-version-from-splunk-logs/m-p/627816#M218129 <P>Are you on Splunk 9.X? If so you can do this ...</P><LI-CODE lang="markup">index=_configtracker sourcetype=splunk_configuration_change "data.path"="/opt/splunk/etc/system/local/migration.conf" | eval old = 'data.changes{}.properties{}.old_value' | eval new = 'data.changes{}.properties{}.new_value' | table host old new</LI-CODE> Fri, 20 Jan 2023 19:08:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-ITSI-old-and-current-version-from-splunk-logs/m-p/627816#M218129 fredclown 2023-01-20T19:08:39Z https://community.splunk.com/t5/Splunk-Search/How-to-find-ITSI-old-and-current-version-from-splunk-logs/m-p/628212#M218231 <P>Does this meet your requirements?</P> Tue, 24 Jan 2023 22:43:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-ITSI-old-and-current-version-from-splunk-logs/m-p/628212#M218231 fredclown 2023-01-24T22:43:46Z