topic Re: WMI in windows 2000 in Getting Data In

WMI in windows 2000

katalinali — Wed, 23 Jun 2010 09:33:05 GMT

I have polled wmi query from windows 2000 to splunk, as there is not PerfFormattedData class. I use PerfRawData, but the cpu data in PerfRawData need some calculations so that it will give same result as PerfFormattedData. Can I modify splunk-wmi.exe or have any other method so the data input to splunk is right.

Re: WMI in windows 2000

gkanapathy — Wed, 23 Jun 2010 10:48:09 GMT

You can write new WQL queries in wmi.conf:

http://www.splunk.com/base/Documentation/latest/Admin/MonitorWMIdata#Configure_WMI_with_configuration_files

Re: WMI in windows 2000

katalinali — Wed, 23 Jun 2010 16:58:05 GMT

I know what is wql, my point is the calculation after polling value from wmi and before splunk access. I need the method which allow me to modify the data after generate from splunk-wmi.exe and before index by splunk. As the restricted environment, I can't use external program for the very last minute, so is splunk can provide a way to achieve my goal, for example, may I change some files so the splunk-wmi.exe can do calculation when it queries wql

Thanks

Re: WMI in windows 2000

gkanapathy — Thu, 24 Jun 2010 03:34:00 GMT

No you can't. Of course Splunk provides a large number of commands to evaluate and transform data when you view it instead of when you index it.