All Apps and Add-ons

Operating system versions

udayk1
Path Finder

I have a concern that I want to know what are all the operating versions are being used in our organization. I have tried searching the same through different queries like windows wild card and stuff like that, but seems no luck.

Any special query to get this?

0 Karma

somesoni2
Revered Legend

The Splunk 5.x App for windows should have come up with a WMI input (check wmi.conf file, sourcetype=WMI:Version). Ensure that that is enabled. Then following should give you the OS information

index=main sourcetype="WMI:Version" | rex "Caption=(?<OS>.*)" | table host, OS, Version, ServicePackMajorVersion, ServicePackMinorVersion

Just for reference, following is the content of wmi.conf for [WMI:Version].

wmi.conf

[WMI:Version]
disabled = 1
## Run once per day
interval = 86400
wql = SELECT Caption, ServicePackMajorVersion, ServicePackMinorVersion, Version FROM Win32_OperatingSystem
0 Karma

udayk1
Path Finder

Hey thanks a lot. But if I want to get the versions of Operating systems i.e. Windows 7, XP and etc?

0 Karma

somesoni2
Revered Legend

Try this

index=_internal source=*metrics.log | stats count by hostname, os

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...