https://community.splunk.com/t5/Getting-Data-In/Enable-WMI-LocalNetwork/m-p/49237#M9366 <P>Hello rgraetz,</P> <P>Here are some assumptions I am making about your question, if these are incorrect then please clarify in your question.</P> <P>1: That you have the Windows App installed and are using it to gather WMI information.</P> <P>2: That you are not using deployment clients or light weight forwarders.</P> <P>If that is the case then in the folder %SPLUNK-INSTALL%\etc\apps\windows\local (ex. C:\Program Files\Splunk\etc\apps\windows\local) on the server you want to monitor there should be a file called wmi.conf that holds configurations for WMI inputs. It's got stanzas like this inside:</P> <PRE><CODE> [WMI:FreeDiskSpace] interval = 60 disabled = 0 server = localhost </CODE></PRE> <P>You want to Add (or un-disable) the LocalNetwork one, which will look something like this:</P> <PRE><CODE>[WMI:LocalNetwork] interval = 300 disabled = 0 </CODE></PRE> <P>TL;DR: The correct config file is wmi.conf in the folder %SPLUNK-INSTALL%\etc\apps\windows\local and the syntax is like above <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 01 Mar 2011 05:48:37 GMT proctorgeorge 2011-03-01T05:48:37Z https://community.splunk.com/t5/Getting-Data-In/Enable-WMI-LocalNetwork/m-p/49236#M9365 <P>Hello,</P> <P>How to enable WMI:LocalNetwork? Where is the correct config file? Doesn't find anything about the syntax in the wiki.....</P> <P>thx alot.....</P> Thu, 24 Feb 2011 05:01:28 GMT https://community.splunk.com/t5/Getting-Data-In/Enable-WMI-LocalNetwork/m-p/49236#M9365 rgraetz 2011-02-24T05:01:28Z https://community.splunk.com/t5/Getting-Data-In/Enable-WMI-LocalNetwork/m-p/49237#M9366 <P>Hello rgraetz,</P> <P>Here are some assumptions I am making about your question, if these are incorrect then please clarify in your question.</P> <P>1: That you have the Windows App installed and are using it to gather WMI information.</P> <P>2: That you are not using deployment clients or light weight forwarders.</P> <P>If that is the case then in the folder %SPLUNK-INSTALL%\etc\apps\windows\local (ex. C:\Program Files\Splunk\etc\apps\windows\local) on the server you want to monitor there should be a file called wmi.conf that holds configurations for WMI inputs. It's got stanzas like this inside:</P> <PRE><CODE> [WMI:FreeDiskSpace] interval = 60 disabled = 0 server = localhost </CODE></PRE> <P>You want to Add (or un-disable) the LocalNetwork one, which will look something like this:</P> <PRE><CODE>[WMI:LocalNetwork] interval = 300 disabled = 0 </CODE></PRE> <P>TL;DR: The correct config file is wmi.conf in the folder %SPLUNK-INSTALL%\etc\apps\windows\local and the syntax is like above <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 01 Mar 2011 05:48:37 GMT https://community.splunk.com/t5/Getting-Data-In/Enable-WMI-LocalNetwork/m-p/49237#M9366 proctorgeorge 2011-03-01T05:48:37Z