Skip to main content
Splunk Lantern

ESXi host version identification


A report of the versions of VMWare ESXi actively running within your virtualization environment can help you identify version inconsistencies or older versions in need of upgrade.

Data required 


  1. Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
  2. Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations. 
  3. Run the following search. You can optimize it by specifying an index and adjusting the time range.
| mcatalog values(os_version) AS esxiversion WHERE index=vmware-perf-metrics AND entity_type=vsphere.esxihost BY name
| dedup name sortby - _time
| stats count BY esxiversion

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation
| mcatalog values(os_version) AS esxiversion WHERE index=vmware-perf-metrics AND entity_type=vsphere.esxihost BY name

Search VMWare metric indexes for ESXi version values by ESXi host.

| dedup name sortby - _time

Remove duplicate ESXi hosts from the results.

| stats count BY esxiversionmoid="*"

Provide a count of the results, sorted by version ID.

Next steps 

Upgrade versions as needed.

You might be interested in other processes associated with the Monitoring VMware virtual machine performance use case.