Splunk Search

How to monitor and search for OS (Windows, Linux, etc) and server version?

kpavan
Path Finder

Hi All,

Need to find Windows Edition through splunk query like Windows 2003, Vista, 2008 etc..

I checked query index=_internal (source=*metrics.log) |dedup os,hostname | rename hostname as host| table os,host. This query gives only OS type Windows and linux but need query which can tell specifically like windows 2003. Could you please help me on this.

Thanks in advance!

0 Karma

jconger
Splunk Employee
Splunk Employee

You can add the following to inputs.conf on your Windows hosts:

[WinHostMon://os]
interval = -1
type = operatingSystem

This will index the OS level stuff at startup. Here is an example of the output:

Type=OperatingSystem
OS="Microsoft Windows Server 2008 R2 Standard"
Architecture="64-bit"
Version="6.1.7601"
BuildNumber="7601"
BuildType="Multiprocessor Free"
ServicePack="Service Pack 1"
SerialNumber="xxxxxx"
ComputerName="xxxxxx"
InstallDate="20140115133155.000000-360"
LastBootUpTime="20141016084054.629375-300"
Locale="0409"
TotalPhysicalMemoryKB="2096696"
FreePhysicalMemoryKB="618044"
TotalVirtualMemoryKB="4193392"
FreeVirtualMemoryKB="2425360"
Status="OK"
CodeSet="1252"
CountryCode="1"
SystemDevice="\Device\HarddiskVolume2"
SystemDrive="C:"
SystemDirectory="C:\Windows\system32"

Check out inputs.conf.spec (http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/inputsconf) for all options.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...