https://community.splunk.com/t5/Getting-Data-In/How-to-collect-Windows-service-status/m-p/474058#M81411 <P>I'm trying to collect the status of two windows services but I don't need the status of the rest of the services on the boxes. If I put in a WinHostMon stanza it collects everything but I can't seem to whitelist just the two I want. </P> <P>Is there an easy way to do this without creating a props and transform? <BR /> I tried configuring at WMI stanza but I don't have something incorrect. <BR /> See my example stanza below:</P> <PRE><CODE>[WMI:Services] interval = 300 disabled = 0 index = MyIndex sourcetype = dwps-service whitelist = "service1" whitelist1 = "service2" wql = select Name, DisplayName, State, Status, StartName FROM Win32_Service </CODE></PRE> Thu, 31 Oct 2019 22:04:33 GMT morphis72 2019-10-31T22:04:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-collect-Windows-service-status/m-p/474058#M81411 <P>I'm trying to collect the status of two windows services but I don't need the status of the rest of the services on the boxes. If I put in a WinHostMon stanza it collects everything but I can't seem to whitelist just the two I want. </P> <P>Is there an easy way to do this without creating a props and transform? <BR /> I tried configuring at WMI stanza but I don't have something incorrect. <BR /> See my example stanza below:</P> <PRE><CODE>[WMI:Services] interval = 300 disabled = 0 index = MyIndex sourcetype = dwps-service whitelist = "service1" whitelist1 = "service2" wql = select Name, DisplayName, State, Status, StartName FROM Win32_Service </CODE></PRE> Thu, 31 Oct 2019 22:04:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-collect-Windows-service-status/m-p/474058#M81411 morphis72 2019-10-31T22:04:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-collect-Windows-service-status/m-p/474059#M81412 <P>Greetings @morphis72,</P> <P>I would just grab all the services and filter within Splunk.</P> <P>If you really don't want to go that route, you should be able to do this:</P> <PRE><CODE> [WMI:Services] interval = 300 disabled = 0 index = MyIndex sourcetype = dwps-service wql = select Name, DisplayName, State, Status, StartName FROM Win32_Service WHERE Name = "service1" OR Name = "service2" </CODE></PRE> <P>See here for everything you can do with WMI querying: <A href="https://www.darkoperator.com/blog/2013/3/11/introduction-to-wmi-basics-with-powershell-part-3-wql-and-se.html">https://www.darkoperator.com/blog/2013/3/11/introduction-to-wmi-basics-with-powershell-part-3-wql-and-se.html</A></P> <P>Cheers,<BR /> Jacob</P> Thu, 31 Oct 2019 22:33:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-collect-Windows-service-status/m-p/474059#M81412 jacobpevans 2019-10-31T22:33:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-collect-Windows-service-status/m-p/474060#M81413 <P>Hi Jacob,</P> <P>Thanks for the response. I tried the above stanza with my two service names I'm shooting for but didn't get anything back. </P> <P>This is what the event looks like when I pull it in with WinHostMon and for the in the wql statment above I'm using name = "Blue Prism Server"</P> <P>Type=Service<BR /> Name="Blue Prism Server"<BR /> DisplayName="Blue Prism Server"<BR /> Description="The Blue Prism Server Service"<BR /> Path="C:\Program Files\Blue Prism Limited\Blue Prism Automate\BPServerService.exe"<BR /> ServiceType="Own Process"<BR /> StartMode="Manual"<BR /> Started=false<BR /> State="Stopped"<BR /> Status="OK"<BR /> ProcessId=0</P> Fri, 01 Nov 2019 14:49:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-collect-Windows-service-status/m-p/474060#M81413 morphis72 2019-11-01T14:49:17Z