Splunk Search

I have a query to fetch Kernel version from all the Linux servers

Hema_Nithya
Explorer

I have a query to fetch Kernel version from all the Linux servers . We update the Kernel Patch every quarter . I have to hardcode the kernel versions in the search query 3.10.0-1160.92.1.el7.x86_64  every quarter . 

There are 3 versions  which I need to hardcode in the search query . Is there any specific way where we can update the query automatic . 

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You could externalise the versions to a lookup file and the query could get the versions from that lookup file and use those values in the query, e.g. if you had a lookup file with 

version,date_from
3.10.0-1160.92.1.el7.x86_64,2023-11-06

then the query could use a subsearch to get the latest version based on date_from field in the lookup to use in the query.

As for how to update that automatically, it would depend on where your data is coming from. You could use the REST api to perform actions on the Splunk server. 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...