https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43655#M1445 <P>Oh so you mean the other way around? You're running Splunk on Windows but have remote logs on a Unix box? In that case you can't use WMI at all, it's Windows only. For getting events from your remote Unix box, you should install a Universal Forwarder on it and have it send the events back to your indexer. Or configure it to send syslog.</P> Thu, 23 May 2013 10:11:20 GMT Ayn 2013-05-23T10:11:20Z https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43652#M1442 <P>Hello Team,<BR /> I am new to splunk,<BR /> I need to collect Remote event Log on my Windows splunk server.<BR /> So Under my splunk GUI <BR /> <STRONG>Manager » Data inputs » Event log collections » My_server_logs</STRONG><BR /> It Gives Me error : </P> <HR /> <P><STRONG>Failed to fetch data: In handler 'win-wmi-enum-eventlogs': Unable to get wmi classes from host '10.151.57.199'. This host may not be reachable or WMI may be misconfigured</STRONG>.</P> <P>Now the log i am fetching is a Unix Machine so do i need to configure the win-wmi on unix or there is any other tool i need to configure for this.<BR /> please share the sequence of steps to configure this.</P> Mon, 28 Sep 2020 13:57:43 GMT https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43652#M1442 dineshahlawat 2020-09-28T13:57:43Z https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43653#M1443 <P>You can't do WMI polling on non-Windows systems, because it uses native Windows libraries.</P> Thu, 23 May 2013 08:09:47 GMT https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43653#M1443 Ayn 2013-05-23T08:09:47Z https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43654#M1444 <P>OK so what can i do to access the unix logs.<BR /> please share any reference to configure.</P> Thu, 23 May 2013 08:46:00 GMT https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43654#M1444 dineshahlawat 2013-05-23T08:46:00Z https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43655#M1445 <P>Oh so you mean the other way around? You're running Splunk on Windows but have remote logs on a Unix box? In that case you can't use WMI at all, it's Windows only. For getting events from your remote Unix box, you should install a Universal Forwarder on it and have it send the events back to your indexer. Or configure it to send syslog.</P> Thu, 23 May 2013 10:11:20 GMT https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43655#M1445 Ayn 2013-05-23T10:11:20Z https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43656#M1446 <P>Thanks Ayn, For clearing this doubt. Can you please share the steps to configure the Universal Forwarder (ON UNIX) to forward the log file to Splunk.</P> Thu, 23 May 2013 10:41:51 GMT https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43656#M1446 dineshahlawat 2013-05-23T10:41:51Z https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43657#M1447 <P>Read docs. <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Deploymentoverview">http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Deploymentoverview</A></P> Thu, 23 May 2013 11:04:25 GMT https://community.splunk.com/t5/Security/collect-Remote-event-log-on-my-Windows-splunk-server/m-p/43657#M1447 Ayn 2013-05-23T11:04:25Z