topic Re: Will Splunk WMI inputs work on servers not in same domain? in Getting Data In

Will Splunk WMI inputs work on servers not in same domain?

maverick — Tue, 26 Apr 2011 18:39:38 GMT

I need to set up WMI polling on my Windows boxes that cannot run agents or belong to a domain.

With Splunk, is it possible to use local accounts for WMI polling provided that the permissions are set correctly?

Re: Will Splunk WMI inputs work on servers not in same domain?

maverick — Tue, 26 Apr 2011 18:42:56 GMT

If the machines are not in a domain, then you can query them from another stand-alone Windows server if the user name (i.e. the name Splunk is installed as on the collector) also exists as a local administrator on the target machine(s).

e.g. install splunk as myhost\foo, where $everyremotehost also has an account ‘foo’ with sufficient (probably local administrator) permissions.

Note: you will probably want to wrap that in a VPN or native IPSec, as without a domain, Windows reverts to NTLMv2, which I believe is crackable.

Re: Will Splunk WMI inputs work on servers not in same domain?

mw — Wed, 27 Apr 2011 00:25:32 GMT

Your backslash was lost in myhost\foo

Re: Will Splunk WMI inputs work on servers not in same domain?

maverick — Wed, 27 Apr 2011 01:32:16 GMT

thanks and corrected!