topic Re: Why isn't WMI class working with Splunk? in Getting Data In

Why isn't WMI class working with Splunk?

jip31 — Wed, 03 Oct 2018 10:15:52 GMT

hello

I fluently use WMI request with Splunk.

until now, i haven't had any problems.

I have to use these 2 WMI classes, but Splunk is unable to request from them.

Anybody have an idea why this is happening? Are there some restrictions between Splunk and WMI???

[WMI:BatteryFull]
disabled = 0
interval = 30
wql = SELECT * FROM BatteryFullChargedCapacity
index = windows-wmi

[WMI:BatteryStatic]
disabled = 0
interval = 30
wql = SELECT * FROM BatteryStaticData
index = windows-wmi

Re: Why isn't WMI class working with Splunk?

jip31 — Thu, 04 Oct 2018 06:22:32 GMT

nobody has an idea please??

Re: Why isn't WMI class working with Splunk?

jip31 — Thu, 04 Oct 2018 11:32:54 GMT

Dont you think its because the WMI namespace that Splunk Enterprise accesses (most commonly Root\CIMV2) must have proper permissions. These permissions must be set manually on each host in your enterprise, as there is no global WMI security. ?

Re: Why isn't WMI class working with Splunk?

jip31 — Sat, 06 Oct 2018 05:04:16 GMT

I checked the log and i have this :
10-06-2018 06:59:44.210 +0200 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Specified class is not valid." HRESULT=80041010) (root\cimv2: SELECT * FROM BatteryFullChargedCapacity)

is thre omething to do for doing valid a wmi class??

Re: Why isn't WMI class working with Splunk?

hnorvik — Fri, 08 Jul 2022 16:07:21 GMT

Taking a chance on answering an old question here since I got stuck with the same issue.....

It now worked fine on my Universal forwarder. You just need to add this line to wmi.conf:

namespace = root\wmi

I also noticed that when doing the splunk cmd test query you need to pay attention to the case of -namespace

-Namespace triggers an error while -namespace works fine.