https://community.splunk.com/t5/Getting-Data-In/Impossible-to-use-WMI/m-p/378611#M68486 <P>hi</P> <P>in wmi.conf i have the code below<BR /> but when i done index="windows-wmi" sourcetype="WMI:Reliability" nothing is displayed<BR /> could you help me please??</P> <PRE><CODE>[settings] initial_backoff = 5 max_backoff = 20 max_retries_at_max_backoff = 2 checkpoint_sync_interval = 2 ## Reliability [WMI:Reliability] disabled = 0 interval = 2 wql = SELECT * FROM Win32_ReliabilityRecords index = windows-wmi </CODE></PRE> Tue, 01 May 2018 15:16:08 GMT jip31 2018-05-01T15:16:08Z https://community.splunk.com/t5/Getting-Data-In/Impossible-to-use-WMI/m-p/378611#M68486 <P>hi</P> <P>in wmi.conf i have the code below<BR /> but when i done index="windows-wmi" sourcetype="WMI:Reliability" nothing is displayed<BR /> could you help me please??</P> <PRE><CODE>[settings] initial_backoff = 5 max_backoff = 20 max_retries_at_max_backoff = 2 checkpoint_sync_interval = 2 ## Reliability [WMI:Reliability] disabled = 0 interval = 2 wql = SELECT * FROM Win32_ReliabilityRecords index = windows-wmi </CODE></PRE> Tue, 01 May 2018 15:16:08 GMT https://community.splunk.com/t5/Getting-Data-In/Impossible-to-use-WMI/m-p/378611#M68486 jip31 2018-05-01T15:16:08Z https://community.splunk.com/t5/Getting-Data-In/Impossible-to-use-WMI/m-p/378612#M68487 <P>nobody for advicing me please???</P> Wed, 02 May 2018 05:28:10 GMT https://community.splunk.com/t5/Getting-Data-In/Impossible-to-use-WMI/m-p/378612#M68487 jip31 2018-05-02T05:28:10Z https://community.splunk.com/t5/Getting-Data-In/Impossible-to-use-WMI/m-p/378613#M68488 <P>Unless someone can spot some obvious error, I think this will need some structured troubleshooting.</P> <P>Can you share your Splunk architecture (is this just a single local Windows Splunk instance, or is this inputs.conf on a forwarder that sends it to a distributed setup?)?</P> <P>Any errors in this instance's splunkd.log?<BR /> If it is not a single instance: is the forwarding connection working properly in general?<BR /> Does the account splunk runs under have permissions to read that particular WMI source?<BR /> Does that index exist (on your indexer)?</P> <P>Have you tried the WMI test procedure? <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata#Test_access_to_WMI_providers">http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata#Test_access_to_WMI_providers</A></P> Wed, 02 May 2018 07:11:00 GMT https://community.splunk.com/t5/Getting-Data-In/Impossible-to-use-WMI/m-p/378613#M68488 FrankVl 2018-05-02T07:11:00Z https://community.splunk.com/t5/Getting-Data-In/Impossible-to-use-WMI/m-p/378614#M68489 <P>Hi yes i tried thé procédure<BR /> I just use SPLUNK on my local system<BR /> And yes i have created the windows WMI index </P> Wed, 02 May 2018 09:09:28 GMT https://community.splunk.com/t5/Getting-Data-In/Impossible-to-use-WMI/m-p/378614#M68489 jip31 2018-05-02T09:09:28Z