Splunk Search

How do I search for Windows Servers Version (2008, 2012 etc)?

etorres
Loves-to-Learn

Splunk Noob here.  How do I search for Windows Servers Version (2008, 2012 etc)?  Can this be done?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @etorres,

I suppose that you're using the Splunk_TA_Windows to take logs from your Windows Servers, if this is true. you have to enable the first Host Monitoring Stanza

 

[WinHostMon://Computer]
interval = 600
disabled = 0
type = Computer

 

to have the information about OS.

Otherwise you can have these information from the Deployment Server.

Ciao.

Giuseppe

0 Karma

martinpu
Communicator

It depends on what you are logging. If you search for 2008 or 2012 do you find any matches from your windows logs?
If you match the OS version from the logs then you can extract that as a field.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...