Splunk Search

How do I search for Windows Servers Version (2008, 2012 etc)?

etorres
Loves-to-Learn Lots

Splunk Noob here.  How do I search for Windows Servers Version (2008, 2012 etc)?  Can this be done?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @etorres,

I suppose that you're using the Splunk_TA_Windows to take logs from your Windows Servers, if this is true. you have to enable the first Host Monitoring Stanza

 

[WinHostMon://Computer]
interval = 600
disabled = 0
type = Computer

 

to have the information about OS.

Otherwise you can have these information from the Deployment Server.

Ciao.

Giuseppe

martinpu
Communicator

It depends on what you are logging. If you search for 2008 or 2012 do you find any matches from your windows logs?
If you match the OS version from the logs then you can extract that as a field.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...