Splunk Search

How do I search for Windows Servers Version (2008, 2012 etc)?

etorres
Loves-to-Learn Lots

Splunk Noob here.  How do I search for Windows Servers Version (2008, 2012 etc)?  Can this be done?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @etorres,

I suppose that you're using the Splunk_TA_Windows to take logs from your Windows Servers, if this is true. you have to enable the first Host Monitoring Stanza

 

[WinHostMon://Computer]
interval = 600
disabled = 0
type = Computer

 

to have the information about OS.

Otherwise you can have these information from the Deployment Server.

Ciao.

Giuseppe

martinpu
Communicator

It depends on what you are logging. If you search for 2008 or 2012 do you find any matches from your windows logs?
If you match the OS version from the logs then you can extract that as a field.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...