Search to list all UF's and OS including version number (Windows Server 2008 RS, Windows Server 2016)

[tsheets13]

I did this a few weeks ago and now I can't seem figure out how I did it.

I need a report listing all UFs, with their version of splunk UF as well as specific OS version.

Searched all over here and couldn't find it.

[gcusello · Accepted solution]

Hi @tsheets13,
did you explored the Monitoring Console?
at [Settings -- Monitoring Console -- Forwarders -- Forwarders Deployment].
Otherwise you could deploy TA_Windows and TA_nix on servers and in each of these Technical-Addons there a script that extract the os version and you can use this info.

Ciao.
Giuseppe

[tsheets13]

The windows and nix TA's are installed. Just not sure how to form the report.

[gcusello]

Hi @tsheets13,
you have to enable the scripts:

[WinHostMon://OperatingSystem] on TA_Windows

and

[script://./bin/hardware.sh] on TA_nix

and then search something like this:
for windows:

index=windows sourcetype=WinHostMon Type=OperatingSystem
| dedup host
| sort host
| table OS Version ServicePack BuildNumber SerialNumber InstallDate LastBootUpTime
| evalInstallDate=strftime(strptime(InstallDate,"%Y%m%d%H%M%S"),"%d/%m/%Y %H.%M.%S"),LastBootUpTime=strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H.%M.%S")

and for linux

index=os sourcetype=Unix:Version
| dedup host
| table os_name os_release os_version machine_architecture_name
| rename os_name AS "Operative System" os_release AS Release os_version AS Version machine_architecture_name AS Architecture

or if you want only one search

(index=windows sourcetype=WinHostMon Type=OperatingSystem) OR (index=os sourcetype=Unix:Version)
| dedup host
| sort host
| ...

Ciao.
Giuseppe

[tsheets13]

Those two searches are exactly what I was looking for. Thanks

[gcusello]

Hi @tsheets13,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉