I have a query to fetch Kernel version from all the Linux servers

[Hema_Nithya]

I have a query to fetch Kernel version from all the Linux servers . We update the Kernel Patch every quarter . I have to hardcode the kernel versions in the search query 3.10.0-1160.92.1.el7.x86_64  every quarter . 

There are 3 versions  which I need to hardcode in the search query . Is there any specific way where we can update the query automatic . 

[bowesmana]

You could externalise the versions to a lookup file and the query could get the versions from that lookup file and use those values in the query, e.g. if you had a lookup file with 

version,date_from
3.10.0-1160.92.1.el7.x86_64,2023-11-06

then the query could use a subsearch to get the latest version based on date_from field in the lookup to use in the query.

As for how to update that automatically, it would depend on where your data is coming from. You could use the REST api to perform actions on the Splunk server.