You could query your forwarders' REST API for the /server/info endpoint and use the os_version field to build a lookup or tag list that map host to version.
Not quite straightforward of course, as far as I know you'll only get OS name, architecture, and Splunk version from _internal metrics.
As a small chance, take a a look at the system info output in _internal on bootup of a forwarder. That might contain version info as well, I don't have the systems to verify right now.
... View more