Splunk Search

Can you help me build a search query for checking the latest version of Splunk Enterprise?

whrg
Motivator

Hello all,

I know that Splunk regularly checks for Splunk Enterprise and app updates. There is the "New (maintenance) version available. Check here for details" message as well as app update information under "Manage Apps".

Now I want to build a dashboard that shows any available updates for Splunk Enterprise + Splunk apps.

For Splunk apps, it is possible to run a search which shows available updates for apps and add-ons using the REST API. This works perfectly.

Now my question is: How can I run a search to display the latest version of Splunk Enterprise?

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @whrg

I did some quick investigations into this, and it would appear that the Splunk server itself doesn't actually talk to Splunk servers to find out if a new version is available. You can see this mentioned on this page: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Aboutupdatecheckerdata

Now I did what it suggested and checked my own network traffic when I logged in, and I can see hitting this URL will tell me the latest Splunk version: https://quickdraw.splunk.com/js/pro/7.2.0/login/prod/basic?

I expect there is a unique URL for every version that has ever been deployed, but this URL should still work for a long time and tell you what the latest version of Splunk is. Just get the REST moluar input or some other app to query this URL periodically.

All the best,

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @whrg

I did some quick investigations into this, and it would appear that the Splunk server itself doesn't actually talk to Splunk servers to find out if a new version is available. You can see this mentioned on this page: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Aboutupdatecheckerdata

Now I did what it suggested and checked my own network traffic when I logged in, and I can see hitting this URL will tell me the latest Splunk version: https://quickdraw.splunk.com/js/pro/7.2.0/login/prod/basic?

I expect there is a unique URL for every version that has ever been deployed, but this URL should still work for a long time and tell you what the latest version of Splunk is. Just get the REST moluar input or some other app to query this URL periodically.

All the best,

0 Karma

whrg
Motivator

Hello Chris,
Thank you for your answer!
Interesting. I will see if I can find any documentation on this quickdraw.splunk.com URL.
A REST modular input sounds like a good idea. Or perhaps a custom search command.

0 Karma

Kathir
Loves-to-Learn Everything

v|rest /services/apps/local
|fields author configured disbled eai:aci.owner eai:acl.sharing label title visible check_for_updates update.version version
|dedup title
|table title label author eai:aci.owner eai:acl.sharing configured disabled visible check_for_updates update.version version

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...