Collect Windows Version

[sdwilkerson]

Is there a recommended best-practice for collecting the version of windows that a certain Splunk-instance is running on? In this case, the Deployment Server will be used to push out this "version app" to the enterprise so we can centrally-report on stats by Splunk version.

Thanks,
Sean

[ahall_splunk · Accepted solution]

The REG command can be used to delve into the Windows Registry on any version of Windows since Windows XP. If you happen to be using Windows 2000, the REG command is in the Windows Resource Kit. The key you need is HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProductName. You can use the below code to extract this and return it in a single line so it's suitable for being eaten by Splunk:

@ECHO OFF
SET KEY="HKLM\Software\Microsoft\Windows NT\CurrentVersion"
:: The Delims param is a TAB followed by a SPACE
FOR /F "tokens=2* delims=        " %%A IN ('REG QUERY "%KEY%" /v ProductName') DO SET WindowsVersion=%%B
ECHO WindowsVersion="%WindowsVersion%"

Put this in a WindowsVersion.cmd file and add a scripted input that runs on a regular basis, and you will always be able to pull the list.

There are a bunch of other keys that may also be useful that can be pulled in the same way. I use this, for instance, to pull the place where Exchange Server is installed in the upcoming Splunk App for Microsoft Exchange.