topic windows logs in Getting Data In

windows logs

kovacez — Thu, 06 Oct 2011 18:20:42 GMT

Hello everybody,
I am really newbie @splunk. please bare with me

I downloaded windows app. I am trying to configure splunk to monitor windows server. So i am going through the wizard, clicked on Get remote event logs via WMI > specified the host and clicked on tab "find logs" and the search returns :
Failed to fetch data: In handler 'win-wmi-enum-eventlogs': Unable to get wmi classes from host '10.1.6.19'. This host may not be reachable or WMI may be misconfigured.

Any ideas why? If i should configure the rights to the windows servers, where that would be? I checked the forums and documentation and could not find the answer
thx

Re: windows logs

kovacez — Thu, 06 Oct 2011 20:32:48 GMT

here is the fix
http://splunk-base.splunk.com/answers/3701/how-to-get-wmi-data-collection-by-providing-to-splunk-the-remote-host-credentials

Re: windows logs

jacksamson — Thu, 04 Feb 2016 19:46:52 GMT

Ensure the SplunkForwarder service Log On is a Domain Admin account.

Run services.msc and ensure “Windows Management Instrumentation” service Startup Type is set to Automatic.

In Firewall settings, click on the “Advanced settings” link. For the Inbound Rules, ensure “Windows Management Instrumentation (WMI-In)” is Enabled and Allowed for the Profile called Domain.