https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-collect-WMI-events/m-p/91926#M19102 <P>Splunk stores the information regarding what it is monitoring in the wmi_checkpoint file that is stored in %SPLUNK_HOME%\var\lib\splunk\persistentstorage. The error is encountered when wmi_checkpoint is corrupted or inaccessible. Check the following:</P> <OL> <LI><P>if you have virus scan enabled, stop it "completely" and see if this resolves the issue.</P></LI> <LI><P>Check if you have any permission issue. Make sure the account starting Splunk services has a full control to %SPLUNK_HOME% directory.</P></LI> <LI><P>If it is corrupted, once you move wmi_checkpoint from %SPLUNK_HOME%\var\lib\splunk\persistentstorage Splunk will reindex. Please note that this can cause Splunk to reindex Windows Event Log pulled via wmi.</P></LI> </OL> <P>If none of the above is identified as a problem, then contact Support by submitting diag and %SPLUNK_HOME%\var\lib\splunk\persistentstorage.</P> Fri, 19 Nov 2010 00:37:53 GMT elusive 2010-11-19T00:37:53Z https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-collect-WMI-events/m-p/91925#M19101 <P>Splunk was collecting event before but suddenly it stopped collecting events. I have restarted Splunk several times. I see the following message being logged in splunkd.log:</P> <PRE><CODE>11-02-2010 15:53:02.028 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-wmi.exe"" WMI - Unable to read from the WMI checkpoint storage: Error executing: select value from keyvaluepairs_t where primarykey=?1; Msg=unable to open database file </CODE></PRE> Fri, 19 Nov 2010 00:26:47 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-collect-WMI-events/m-p/91925#M19101 elusive 2010-11-19T00:26:47Z https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-collect-WMI-events/m-p/91926#M19102 <P>Splunk stores the information regarding what it is monitoring in the wmi_checkpoint file that is stored in %SPLUNK_HOME%\var\lib\splunk\persistentstorage. The error is encountered when wmi_checkpoint is corrupted or inaccessible. Check the following:</P> <OL> <LI><P>if you have virus scan enabled, stop it "completely" and see if this resolves the issue.</P></LI> <LI><P>Check if you have any permission issue. Make sure the account starting Splunk services has a full control to %SPLUNK_HOME% directory.</P></LI> <LI><P>If it is corrupted, once you move wmi_checkpoint from %SPLUNK_HOME%\var\lib\splunk\persistentstorage Splunk will reindex. Please note that this can cause Splunk to reindex Windows Event Log pulled via wmi.</P></LI> </OL> <P>If none of the above is identified as a problem, then contact Support by submitting diag and %SPLUNK_HOME%\var\lib\splunk\persistentstorage.</P> Fri, 19 Nov 2010 00:37:53 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-collect-WMI-events/m-p/91926#M19102 elusive 2010-11-19T00:37:53Z