https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-universal-forwarder-to-collect-System/m-p/365107#M66484 <P>if you look in the example conf file at the bottom of that page, specifically at the wql settings, you should see how to query wmi. For example:</P> <PRE><CODE>[WMI:LocalPhysicalDisk] interval = 1 wql = select Name, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk disabled = 0 index = wmi_perfmon </CODE></PRE> <P>If you need to know where in WMI to find the data you want, that's probably going to be all <A href="https://www.google.com/search?q=wmi+total+memory">google</A>. For example, the <A href="https://msdn.microsoft.com/en-us/library/aa394102(v=vs.85).aspx">win32_computersystem</A> class has a field for TotalPhysicalMemory. And the <A href="https://msdn.microsoft.com/en-us/library/aa394347(v=vs.85).aspx">win32_physicalmemory</A> class has a field called capacity. </P> <P>I guess another option is to see if the <A href="https://splunkbase.splunk.com/app/742/">add-on for windows</A> would work for you too. Maybe that would be easier?</P> Mon, 03 Jul 2017 21:20:44 GMT maciep 2017-07-03T21:20:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-universal-forwarder-to-collect-System/m-p/365104#M66481 <P>How can I configure the universal forwarder to collect the hosts system properties?</P> Tue, 27 Jun 2017 20:47:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-universal-forwarder-to-collect-System/m-p/365104#M66481 jrhoads 2017-06-27T20:47:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-universal-forwarder-to-collect-System/m-p/365105#M66482 <P>You should be able to use <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Wmiconf" target="_blank">wmi.conf</A> to query whatever WMI classes you'd like (win32_computersystem, win32_operatingsystem, etc).</P> Tue, 29 Sep 2020 14:44:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-universal-forwarder-to-collect-System/m-p/365105#M66482 maciep 2020-09-29T14:44:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-universal-forwarder-to-collect-System/m-p/365106#M66483 <P>If I search the link provided and search for the win32_* items mentioned there is no reference found. Are there example configurations for System Assigned Ram, etc?</P> Mon, 03 Jul 2017 20:57:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-universal-forwarder-to-collect-System/m-p/365106#M66483 jrhoads 2017-07-03T20:57:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-universal-forwarder-to-collect-System/m-p/365107#M66484 <P>if you look in the example conf file at the bottom of that page, specifically at the wql settings, you should see how to query wmi. For example:</P> <PRE><CODE>[WMI:LocalPhysicalDisk] interval = 1 wql = select Name, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk disabled = 0 index = wmi_perfmon </CODE></PRE> <P>If you need to know where in WMI to find the data you want, that's probably going to be all <A href="https://www.google.com/search?q=wmi+total+memory">google</A>. For example, the <A href="https://msdn.microsoft.com/en-us/library/aa394102(v=vs.85).aspx">win32_computersystem</A> class has a field for TotalPhysicalMemory. And the <A href="https://msdn.microsoft.com/en-us/library/aa394347(v=vs.85).aspx">win32_physicalmemory</A> class has a field called capacity. </P> <P>I guess another option is to see if the <A href="https://splunkbase.splunk.com/app/742/">add-on for windows</A> would work for you too. Maybe that would be easier?</P> Mon, 03 Jul 2017 21:20:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-universal-forwarder-to-collect-System/m-p/365107#M66484 maciep 2017-07-03T21:20:44Z