All Apps and Add-ons

Operating system versions

udayk1
Path Finder

I have a concern that I want to know what are all the operating versions are being used in our organization. I have tried searching the same through different queries like windows wild card and stuff like that, but seems no luck.

Any special query to get this?

0 Karma

somesoni2
Revered Legend

The Splunk 5.x App for windows should have come up with a WMI input (check wmi.conf file, sourcetype=WMI:Version). Ensure that that is enabled. Then following should give you the OS information

index=main sourcetype="WMI:Version" | rex "Caption=(?<OS>.*)" | table host, OS, Version, ServicePackMajorVersion, ServicePackMinorVersion

Just for reference, following is the content of wmi.conf for [WMI:Version].

wmi.conf

[WMI:Version]
disabled = 1
## Run once per day
interval = 86400
wql = SELECT Caption, ServicePackMajorVersion, ServicePackMinorVersion, Version FROM Win32_OperatingSystem
0 Karma

udayk1
Path Finder

Hey thanks a lot. But if I want to get the versions of Operating systems i.e. Windows 7, XP and etc?

0 Karma

somesoni2
Revered Legend

Try this

index=_internal source=*metrics.log | stats count by hostname, os

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...