Getting Data In

Host and OS type

jawehren
Engager

How do I phrase a search to give me all the machines sending data and their OS type?

Tags (2)
0 Karma

JSapienza
Contributor

I know this is an old thread but, here is how I do it :

index=_internal fwdType="*"|dedup sourceHost| table sourceHost, os

southeringtonp
Motivator

The best approach is almost certainly going to be to use a lookup table.

See the link for information on setting up a CSV-based lookup. Once you have such a lookup, you'll be able to do a search such as:

| metadata hosts | lookup mylookup host OUTPUT operating_system

If you have a scripted input running uname -a as Genti suggests, that can be used to populate your table, e.g.:

sourcetype=uname | fields host, operating_system | outputlookup mylookup

Another approach, if you're lucky enough to have all systems in some form of directory would be to use a scripted lookup that leverages LDAP to query (for example) Active Directory.

In a real pinch, you may be able to partially fill your CSV file from data within Splunk. For example, if you see WMI events, you can safely assume that it's a Windows system, and if you see 'ASA' or 'PIX' in syslog data, it's clearly a Cisco firewall.

Ultimately though, the chances are you'll need to manually populate the CSV file.

0 Karma

Genti
Splunk Employee
Splunk Employee
host=*

i do not think there is a way to find out their OS, unless you have some script running uname -a and splunk eating its output...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...