Hi @SN1 If you're looking for Splunk versions and their support status then you can use the following: index=_internal hostname=* os=*
| stats first(fwdType) as fwdType, first(os) as os, first(ve...
See more...
Hi @SN1 If you're looking for Splunk versions and their support status then you can use the following: index=_internal hostname=* os=*
| stats first(fwdType) as fwdType, first(os) as os, first(version) as splunk_version by hostname
| rex field=splunk_version "(?<version_minor>[0-9]+\.[0-9]+)"
| append
[| makeresults format=csv data="version_minor, eos_date
9.0,Jun 14 2024
9.1,Jun 28 2025
9.2,Jan 31 2026
9.3,Jul 24 2026
9.4,Dec 16 2026"
| eval eos_unix=strptime(eos_date,"%b %d %Y") ]
| stats values(hostname) as hosts, first(eos_date) as eos_date, first(eos_unix) as eos_unix by version_minor
| eval support_status=IF(eos_unix>time(),"In Support","Out of Support")
| fillnull eos_date value="Unknown"
| where hosts!="" However if you want the base OS then this might be a little tricker. Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing