Can you help me build a search query for checking the latest version of Splunk Enterprise?

[whrg]

Hello all,

I know that Splunk regularly checks for Splunk Enterprise and app updates. There is the "New (maintenance) version available. Check here for details" message as well as app update information under "Manage Apps".

Now I want to build a dashboard that shows any available updates for Splunk Enterprise + Splunk apps.

For Splunk apps, it is possible to run a search which shows available updates for apps and add-ons using the REST API. This works perfectly.

Now my question is: How can I run a search to display the latest version of Splunk Enterprise?

[chrisyounger · Accepted solution]

Hi @whrg

I did some quick investigations into this, and it would appear that the Splunk server itself doesn't actually talk to Splunk servers to find out if a new version is available. You can see this mentioned on this page: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Aboutupdatecheckerdata

Now I did what it suggested and checked my own network traffic when I logged in, and I can see hitting this URL will tell me the latest Splunk version: https://quickdraw.splunk.com/js/pro/7.2.0/login/prod/basic?

I expect there is a unique URL for every version that has ever been deployed, but this URL should still work for a long time and tell you what the latest version of Splunk is. Just get the REST moluar input or some other app to query this URL periodically.

All the best,

[whrg]

Hello Chris,
Thank you for your answer!
Interesting. I will see if I can find any documentation on this quickdraw.splunk.com URL.
A REST modular input sounds like a good idea. Or perhaps a custom search command.