Skip to main content

 

Splunk Lantern

ESXi host version identification

You might need to report on the versions of VMWare ESXi actively running within your virtualization environment when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

A report of the versions of VMWare ESXi actively running within your virtualization environment can help you identify version inconsistencies or older versions in need of upgrade.

To optimize the search shown below, you should specify an index and a time range.

  1. Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
  2. Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations. 
  3. Run the following search: 
| mcatalog values(os_version) AS esxiversion WHERE index=vmware-perf-metrics AND entity_type=vsphere.esxihost BY name
| dedup name sortby - _time
| stats count BY esxiversion

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation
| mcatalog values(os_version) AS esxiversion WHERE index=vmware-perf-metrics AND entity_type=vsphere.esxihost BY name

Search VMWare metric indexes for ESXi version values by ESXi host.

| dedup name sortby - _time

Remove duplicate ESXi hosts from the results.

| stats count BY esxiversionmoid="*"

Provide a count of the results, sorted by version ID.

Result 

Upgrade versions as needed.