topic Re: Windows WMI configuration in Getting Data In

Windows WMI configuration

phoenixsecure — Fri, 30 Apr 2010 19:14:13 GMT

Hi,

Is there a way to configure how Splunk get the data from WMI for event logs, ex: how often Splunk check the host for logs, when, bandwith max etc.

Thanks.

Re: Windows WMI configuration

the_wolverine — Fri, 30 Apr 2010 19:32:31 GMT

You can configure the polling interval when configuring your WMI input via UI or by editing the wmi.conf file directly. Read the Monitor WMI data section of the documentation for more details about what is configurable and examples:

Re: Windows WMI configuration

Ledio_Ago — Sat, 12 Jun 2010 04:44:47 GMT

The collection of Windows Event Logs via WMI is done in a interval, every 10 seconds by default. This is configurable.

Currently there is not limit on the bandwidth, but that's a good idea and worth looking into it.

Thank you!