Getting Data In

Collect Windows Version

sdwilkerson
Contributor

Is there a recommended best-practice for collecting the version of windows that a certain Splunk-instance is running on? In this case, the Deployment Server will be used to push out this "version app" to the enterprise so we can centrally-report on stats by Splunk version.

Thanks,
Sean

1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

The REG command can be used to delve into the Windows Registry on any version of Windows since Windows XP. If you happen to be using Windows 2000, the REG command is in the Windows Resource Kit. The key you need is HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProductName. You can use the below code to extract this and return it in a single line so it's suitable for being eaten by Splunk:

@ECHO OFF
SET KEY="HKLM\Software\Microsoft\Windows NT\CurrentVersion"
:: The Delims param is a TAB followed by a SPACE
FOR /F "tokens=2* delims=        " %%A IN ('REG QUERY "%KEY%" /v ProductName') DO SET WindowsVersion=%%B
ECHO WindowsVersion="%WindowsVersion%"

Put this in a WindowsVersion.cmd file and add a scripted input that runs on a regular basis, and you will always be able to pull the list.

There are a bunch of other keys that may also be useful that can be pulled in the same way. I use this, for instance, to pull the place where Exchange Server is installed in the upcoming Splunk App for Microsoft Exchange.

View solution in original post

ahall_splunk
Splunk Employee
Splunk Employee

The REG command can be used to delve into the Windows Registry on any version of Windows since Windows XP. If you happen to be using Windows 2000, the REG command is in the Windows Resource Kit. The key you need is HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProductName. You can use the below code to extract this and return it in a single line so it's suitable for being eaten by Splunk:

@ECHO OFF
SET KEY="HKLM\Software\Microsoft\Windows NT\CurrentVersion"
:: The Delims param is a TAB followed by a SPACE
FOR /F "tokens=2* delims=        " %%A IN ('REG QUERY "%KEY%" /v ProductName') DO SET WindowsVersion=%%B
ECHO WindowsVersion="%WindowsVersion%"

Put this in a WindowsVersion.cmd file and add a scripted input that runs on a regular basis, and you will always be able to pull the list.

There are a bunch of other keys that may also be useful that can be pulled in the same way. I use this, for instance, to pull the place where Exchange Server is installed in the upcoming Splunk App for Microsoft Exchange.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...