topic Re: Splunk stopped collectiing Windows Event logs of Remote in Getting Data In

Splunk stopped collectiing Windows Event logs of Remote

quipment — Mon, 04 Feb 2013 14:19:20 GMT

Hi,

We have Windows 2008 R2 SP1 with splunk 5 installed in Domain network.

We have configured to collect windows "System" event log .

But it suddenly stops collecting windows events when the remote system rebooted. and we cannt get events until the "splunkd" service restarted from the server.

After restarting "splunkd" the server starts get collectiong events. but again stops as soon as the remote server or client rebooted.

The firewall is turned off at both ends.

Thanks ,
Prakash

Re: Splunk stopped collectiing Windows Event logs of Remote

sdaniels — Mon, 04 Feb 2013 14:40:50 GMT

It may be helpful to share any errors that you are seeing in the splunkd logs.

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/WhatSplunklogsaboutitself

I would recommend using the Splunk on Splunk App in the future which will help you search across all Splunk logs when you have an issue like this.

Re: Splunk stopped collectiing Windows Event logs of Remote

yannK — Mon, 04 Feb 2013 16:57:59 GMT

make sure that you configured splunk service to start at boot .....

Re: Splunk stopped collectiing Windows Event logs of Remote

quipment — Fri, 15 Feb 2013 06:21:48 GMT

Hi,

Enabled debug logging level for wmi from link and found out wmi will retry after 5000 seconds Ref : http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/TroubleshootingWMI#Splunk_can.27t_get_data_from_remote_machines .

and by editiing wmi.conf from C:\Program Files\Splunk\etc\system\local and setting time out values

Thanks
Prakash