https://community.splunk.com/t5/Security/WMI-Splunk-pull-remote-logs/m-p/443238#M10404 <P>why WMI and not Universal Forwarder?</P> Thu, 12 Jul 2018 22:55:54 GMT adonio 2018-07-12T22:55:54Z https://community.splunk.com/t5/Security/WMI-Splunk-pull-remote-logs/m-p/443237#M10403 <P>What further configuration is needed to pull WMI logs from remote servers, currently we are only getting back data from the local host?</P> <P>Followed this documentation and ensured permissions were correct, to no avail:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorWMIdata">http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorWMIdata</A></P> Thu, 12 Jul 2018 17:17:28 GMT https://community.splunk.com/t5/Security/WMI-Splunk-pull-remote-logs/m-p/443237#M10403 JPaule 2018-07-12T17:17:28Z https://community.splunk.com/t5/Security/WMI-Splunk-pull-remote-logs/m-p/443238#M10404 <P>why WMI and not Universal Forwarder?</P> Thu, 12 Jul 2018 22:55:54 GMT https://community.splunk.com/t5/Security/WMI-Splunk-pull-remote-logs/m-p/443238#M10404 adonio 2018-07-12T22:55:54Z https://community.splunk.com/t5/Security/WMI-Splunk-pull-remote-logs/m-p/443239#M10405 <P>Do you mean use UF to get WMI data? I need WMI because it's the only way to get a certain type of data. I'm trying to pull in data for windows service accounts that are running services across all 200 of my servers.</P> Fri, 13 Jul 2018 15:00:45 GMT https://community.splunk.com/t5/Security/WMI-Splunk-pull-remote-logs/m-p/443239#M10405 JPaule 2018-07-13T15:00:45Z https://community.splunk.com/t5/Security/WMI-Splunk-pull-remote-logs/m-p/443240#M10406 <P>what kind of data are you looking to get out of your 200 windows machines? <BR /> i am almost 100% positive you can leverage the UF to bring that data, easier and cleaner than WMI</P> Sun, 15 Jul 2018 01:45:42 GMT https://community.splunk.com/t5/Security/WMI-Splunk-pull-remote-logs/m-p/443240#M10406 adonio 2018-07-15T01:45:42Z