https://community.splunk.com/t5/Getting-Data-In/Why-is-no-security-data-being-indexed-with-my-current-WMI-input/m-p/151412#M30794 <P>To make this work, we also enabled the scripted input for WMI. Also remember to set interval = 100 (or other lower value). Default value is very high. </P> <PRE><CODE>[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0 interval = 100 </CODE></PRE> <P>Also to check if the data is indexed we used this search below:</P> <PRE><CODE>index= testindex2 </CODE></PRE> Wed, 25 Feb 2015 22:41:08 GMT rbal_splunk 2015-02-25T22:41:08Z https://community.splunk.com/t5/Getting-Data-In/Why-is-no-security-data-being-indexed-with-my-current-WMI-input/m-p/151411#M30793 <P>I am trying to index Security Data from a remote location using the configuration below, but it nothing is getting indexed:</P> <P>$SPLUNK_HOME/etc/system/local/wmi.conf</P> <PRE><CODE>[WMI:testserver1 security log] disabled = 0 event_log_file = Security index = testindex2 interval = 5 server =testserver1 [WMI: testserver2 security log] disabled = 0 event_log_file = Security index = testindex2 interval = 5 server = testserver2 </CODE></PRE> Wed, 25 Feb 2015 22:38:49 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-no-security-data-being-indexed-with-my-current-WMI-input/m-p/151411#M30793 rbal_splunk 2015-02-25T22:38:49Z https://community.splunk.com/t5/Getting-Data-In/Why-is-no-security-data-being-indexed-with-my-current-WMI-input/m-p/151412#M30794 <P>To make this work, we also enabled the scripted input for WMI. Also remember to set interval = 100 (or other lower value). Default value is very high. </P> <PRE><CODE>[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0 interval = 100 </CODE></PRE> <P>Also to check if the data is indexed we used this search below:</P> <PRE><CODE>index= testindex2 </CODE></PRE> Wed, 25 Feb 2015 22:41:08 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-no-security-data-being-indexed-with-my-current-WMI-input/m-p/151412#M30794 rbal_splunk 2015-02-25T22:41:08Z https://community.splunk.com/t5/Getting-Data-In/Why-is-no-security-data-being-indexed-with-my-current-WMI-input/m-p/151413#M30795 <P>Also- refer <A href="http://wiki.splunk.com/Community:TroubleshootingWMIIssues">http://wiki.splunk.com/Community:TroubleshootingWMIIssues</A></P> Wed, 25 Feb 2015 22:53:21 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-no-security-data-being-indexed-with-my-current-WMI-input/m-p/151413#M30795 rbal_splunk 2015-02-25T22:53:21Z