Outdated OS

[SN1]

Where can i get list of all outdated OS for my dashboard. Is there a site or something

[PickleRick]

EMOREWORDS - What do you mean by "oudated OS"? Outdated OS where? Under Splunk components? Running Splunk UFs? Something else?

Remember that Splunk is _not_ an endpoint management system. You must have data in the first place to be able to find something in it. So it's a question for you whether you have the data about OS versions in the first place.

[isoutamo]

This is good point. After thinking this question probably means how to get lis into dashboard which nodes have OS which didn’t contains all latest patches etc?

Can you @SN1 confirm what you are meaning for “outdated os”?

[livehybrid]

Hi @SN1 

If you're looking for Splunk versions and their support status then you can use the following:

index=_internal hostname=* os=* 
| stats first(fwdType) as fwdType, first(os) as os, first(version) as splunk_version by hostname 
| rex field=splunk_version "(?<version_minor>[0-9]+\.[0-9]+)" 
| append 
    [| makeresults format=csv data="version_minor, eos_date
9.0,Jun 14 2024
9.1,Jun 28 2025
9.2,Jan 31 2026
9.3,Jul 24 2026
9.4,Dec 16 2026" 
    | eval eos_unix=strptime(eos_date,"%b %d %Y") ] 
| stats values(hostname) as hosts, first(eos_date) as eos_date, first(eos_unix) as eos_unix by version_minor
| eval support_status=IF(eos_unix>time(),"In Support","Out of Support")
| fillnull eos_date value="Unknown"
| where hosts!=""

However if you want the base OS then this might be a little tricker. 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[isoutamo]

Unfortunately there is no list ready to use.

But you could create it based on this https://docs.splunk.com/Documentation/Splunk/9.4.2/ReleaseNotes/Deprecatedfeatures#Platform_support_... unfortunately you must go through quite many release notes to get splunk version vs deprecated versions.

After that you could utilize @livehybrid 's query with some modifications to utilize your os-support.csv.

Then if you are needing this information also for UFs, you must remember that their support times are longer that core components!

Here is link to Splunk Core support times https://www.splunk.com/en_us/legal/splunk-software-support-policy.html#core and just after it you can see UF's support times which are longer e.g. UF 9.0 ends after 36 month instead of 24 months like core.

[gcusello]

Hi @SN1 ,

what do you mean with "outdated OS"?

then outdated respect what: Splunk or what else?

Could you better describe your requirement?

Ciao.

Giuseppe