https://community.splunk.com/t5/Getting-Data-In/WMI-How-many-remote-Windows-can-a-Splunk-WMI-input-support/m-p/37893#M6963 <P>It depends on how busy the remote hosts are. As a rule of thumb, one Splunk instance (forwarder or indexer) can support the collection of Security Event Logs (the most verbose variety) on between 20 and 50 remote hosts. To scale out collection on more remote hosts, simply add another Splunk instance (forwarder or indexer) to collect another from another 20 to 50 remote hosts. Rinse and repeat.</P> <P>All that said, I would strongly recomment installing the Splunk Forwarder, a relatively lightweight build of Splunk that has no UI and no indexing, on your hosts rather than using WMI. Beyond better resiliance by collecting Event Logs and other WMI data remotely, you will be able to easily collect and forward other data such as DNS, DHCP, Windows Update, and application logs.</P> Fri, 27 Apr 2012 07:17:24 GMT araitz 2012-04-27T07:17:24Z https://community.splunk.com/t5/Getting-Data-In/WMI-How-many-remote-Windows-can-a-Splunk-WMI-input-support/m-p/37892#M6962 <P>Hi</P> <P>I am planning to monitor many Windows client via WMI interface.<BR /> I have one Splunk installed on Windows7.<BR /> How many remote Windows can a Splunk WMI input support?<BR /> Do we have any estimation calculation about the number of max number of target windows hosts?<BR /> 10s, 100s, or 1000s windows hosts?</P> <P>Thanks!</P> Fri, 27 Apr 2012 01:32:40 GMT https://community.splunk.com/t5/Getting-Data-In/WMI-How-many-remote-Windows-can-a-Splunk-WMI-input-support/m-p/37892#M6962 melonman 2012-04-27T01:32:40Z https://community.splunk.com/t5/Getting-Data-In/WMI-How-many-remote-Windows-can-a-Splunk-WMI-input-support/m-p/37893#M6963 <P>It depends on how busy the remote hosts are. As a rule of thumb, one Splunk instance (forwarder or indexer) can support the collection of Security Event Logs (the most verbose variety) on between 20 and 50 remote hosts. To scale out collection on more remote hosts, simply add another Splunk instance (forwarder or indexer) to collect another from another 20 to 50 remote hosts. Rinse and repeat.</P> <P>All that said, I would strongly recomment installing the Splunk Forwarder, a relatively lightweight build of Splunk that has no UI and no indexing, on your hosts rather than using WMI. Beyond better resiliance by collecting Event Logs and other WMI data remotely, you will be able to easily collect and forward other data such as DNS, DHCP, Windows Update, and application logs.</P> Fri, 27 Apr 2012 07:17:24 GMT https://community.splunk.com/t5/Getting-Data-In/WMI-How-many-remote-Windows-can-a-Splunk-WMI-input-support/m-p/37893#M6963 araitz 2012-04-27T07:17:24Z