How do I search for Windows Servers Version (2008, 2012 etc)?

[etorres]

Splunk Noob here.  How do I search for Windows Servers Version (2008, 2012 etc)?  Can this be done?

[gcusello]

Hi @etorres,

I suppose that you're using the Splunk_TA_Windows to take logs from your Windows Servers, if this is true. you have to enable the first Host Monitoring Stanza

[WinHostMon://Computer]
interval = 600
disabled = 0
type = Computer

to have the information about OS.

Otherwise you can have these information from the Deployment Server.

Ciao.

Giuseppe

[martinpu]

It depends on what you are logging. If you search for 2008 or 2012 do you find any matches from your windows logs?
If you match the OS version from the logs then you can extract that as a field.