Getting Data In

Collect Windows Version

sdwilkerson
Contributor

Is there a recommended best-practice for collecting the version of windows that a certain Splunk-instance is running on? In this case, the Deployment Server will be used to push out this "version app" to the enterprise so we can centrally-report on stats by Splunk version.

Thanks,
Sean

1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

The REG command can be used to delve into the Windows Registry on any version of Windows since Windows XP. If you happen to be using Windows 2000, the REG command is in the Windows Resource Kit. The key you need is HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProductName. You can use the below code to extract this and return it in a single line so it's suitable for being eaten by Splunk:

@ECHO OFF
SET KEY="HKLM\Software\Microsoft\Windows NT\CurrentVersion"
:: The Delims param is a TAB followed by a SPACE
FOR /F "tokens=2* delims=        " %%A IN ('REG QUERY "%KEY%" /v ProductName') DO SET WindowsVersion=%%B
ECHO WindowsVersion="%WindowsVersion%"

Put this in a WindowsVersion.cmd file and add a scripted input that runs on a regular basis, and you will always be able to pull the list.

There are a bunch of other keys that may also be useful that can be pulled in the same way. I use this, for instance, to pull the place where Exchange Server is installed in the upcoming Splunk App for Microsoft Exchange.

View solution in original post

ahall_splunk
Splunk Employee
Splunk Employee

The REG command can be used to delve into the Windows Registry on any version of Windows since Windows XP. If you happen to be using Windows 2000, the REG command is in the Windows Resource Kit. The key you need is HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProductName. You can use the below code to extract this and return it in a single line so it's suitable for being eaten by Splunk:

@ECHO OFF
SET KEY="HKLM\Software\Microsoft\Windows NT\CurrentVersion"
:: The Delims param is a TAB followed by a SPACE
FOR /F "tokens=2* delims=        " %%A IN ('REG QUERY "%KEY%" /v ProductName') DO SET WindowsVersion=%%B
ECHO WindowsVersion="%WindowsVersion%"

Put this in a WindowsVersion.cmd file and add a scripted input that runs on a regular basis, and you will always be able to pull the list.

There are a bunch of other keys that may also be useful that can be pulled in the same way. I use this, for instance, to pull the place where Exchange Server is installed in the upcoming Splunk App for Microsoft Exchange.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...