Splunk Search

Can you help me build a search query for checking the latest version of Splunk Enterprise?

whrg
Motivator

Hello all,

I know that Splunk regularly checks for Splunk Enterprise and app updates. There is the "New (maintenance) version available. Check here for details" message as well as app update information under "Manage Apps".

Now I want to build a dashboard that shows any available updates for Splunk Enterprise + Splunk apps.

For Splunk apps, it is possible to run a search which shows available updates for apps and add-ons using the REST API. This works perfectly.

Now my question is: How can I run a search to display the latest version of Splunk Enterprise?

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @whrg

I did some quick investigations into this, and it would appear that the Splunk server itself doesn't actually talk to Splunk servers to find out if a new version is available. You can see this mentioned on this page: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Aboutupdatecheckerdata

Now I did what it suggested and checked my own network traffic when I logged in, and I can see hitting this URL will tell me the latest Splunk version: https://quickdraw.splunk.com/js/pro/7.2.0/login/prod/basic?

I expect there is a unique URL for every version that has ever been deployed, but this URL should still work for a long time and tell you what the latest version of Splunk is. Just get the REST moluar input or some other app to query this URL periodically.

All the best,

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @whrg

I did some quick investigations into this, and it would appear that the Splunk server itself doesn't actually talk to Splunk servers to find out if a new version is available. You can see this mentioned on this page: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Aboutupdatecheckerdata

Now I did what it suggested and checked my own network traffic when I logged in, and I can see hitting this URL will tell me the latest Splunk version: https://quickdraw.splunk.com/js/pro/7.2.0/login/prod/basic?

I expect there is a unique URL for every version that has ever been deployed, but this URL should still work for a long time and tell you what the latest version of Splunk is. Just get the REST moluar input or some other app to query this URL periodically.

All the best,

0 Karma

whrg
Motivator

Hello Chris,
Thank you for your answer!
Interesting. I will see if I can find any documentation on this quickdraw.splunk.com URL.
A REST modular input sounds like a good idea. Or perhaps a custom search command.

0 Karma

Kathir
Loves-to-Learn Everything

v|rest /services/apps/local
|fields author configured disbled eai:aci.owner eai:acl.sharing label title visible check_for_updates update.version version
|dedup title
|table title label author eai:aci.owner eai:acl.sharing configured disabled visible check_for_updates update.version version

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...