Getting Data In

Host and OS type

jawehren
Engager

How do I phrase a search to give me all the machines sending data and their OS type?

Tags (2)
0 Karma

JSapienza
Contributor

I know this is an old thread but, here is how I do it :

index=_internal fwdType="*"|dedup sourceHost| table sourceHost, os

southeringtonp
Motivator

The best approach is almost certainly going to be to use a lookup table.

See the link for information on setting up a CSV-based lookup. Once you have such a lookup, you'll be able to do a search such as:

| metadata hosts | lookup mylookup host OUTPUT operating_system

If you have a scripted input running uname -a as Genti suggests, that can be used to populate your table, e.g.:

sourcetype=uname | fields host, operating_system | outputlookup mylookup

Another approach, if you're lucky enough to have all systems in some form of directory would be to use a scripted lookup that leverages LDAP to query (for example) Active Directory.

In a real pinch, you may be able to partially fill your CSV file from data within Splunk. For example, if you see WMI events, you can safely assume that it's a Windows system, and if you see 'ASA' or 'PIX' in syslog data, it's clearly a Cisco firewall.

Ultimately though, the chances are you'll need to manually populate the CSV file.

0 Karma

Genti
Splunk Employee
Splunk Employee
host=*

i do not think there is a way to find out their OS, unless you have some script running uname -a and splunk eating its output...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...