I have a concern that I want to know what are all the operating versions are being used in our organization. I have tried searching the same through different queries like windows wild card and stuff like that, but seems no luck.
Any special query to get this?
The Splunk 5.x App for windows should have come up with a WMI input (check wmi.conf file, sourcetype=WMI:Version). Ensure that that is enabled. Then following should give you the OS information
index=main sourcetype="WMI:Version" | rex "Caption=(?<OS>.*)" | table host, OS, Version, ServicePackMajorVersion, ServicePackMinorVersion
Just for reference, following is the content of wmi.conf for [WMI:Version].
wmi.conf
[WMI:Version]
disabled = 1
## Run once per day
interval = 86400
wql = SELECT Caption, ServicePackMajorVersion, ServicePackMinorVersion, Version FROM Win32_OperatingSystem
Hey thanks a lot. But if I want to get the versions of Operating systems i.e. Windows 7, XP and etc?
Try this
index=_internal source=*metrics.log | stats count by hostname, os