topic Re: No more Event Logs from Client's in Splunk Search

No more Event Logs from Client's

Rhuen — Tue, 27 Mar 2012 12:42:22 GMT

Hy,

i dont know why, but since 5 days i become no more Event Logs from Client PC's (Windows XP).

When i remote connect to this PC's i see new Events, but Splunk become nothing.
Can i see anywhere why?.

From all Servers i become the logs all the time, only client pc's stop this since 5 days, and i dont know why.

greets.

Re: No more Event Logs from Client's

jgedeon120 — Tue, 27 Mar 2012 13:06:58 GMT

Have you checked the splunkd.log on both server and client?

Re: No more Event Logs from Client's

Rhuen — Mon, 28 Sep 2020 11:34:53 GMT

What i have to check on clients? Clients didnt have a splunkd.log?! :D.
And on Splunk i have 2 errors:

03-27-2012 15:09:18.524 +0200 ERROR splunk-perfmon - PerfmonHelper::enumObjectByNameEx: PdhEnumObjectItems failed for 'Memory' with (0xc0000bb8): Das angegebene Objekt wurde nicht im System gefunden.

03-27-2012 15:13:53.764 +0200 ERROR ExecProcessor - message from "C:\Programme\Splunk\bin\splunk-wmi.exe" WMI - Error occurred while trying to retrieve results from a WMI query (error="Der Remoteprozeduraufruf ist fehlgeschlagen und wurde nicht ausgeführt." HRESULT=800706BF) (\servername\root\cimv2: Select PercentProcessorTime,PercentUserTime from Win32_PerfFormattedData_PerfOS_Processor where Name = "_Total")

Re: No more Event Logs from Client's

jgedeon120 — Tue, 27 Mar 2012 13:26:08 GMT

I would check client event logs since you are collecting with WMI.

Re: No more Event Logs from Client's

Rhuen — Wed, 28 Mar 2012 10:24:06 GMT

I was now change the configuration from "Computername" to there IP-Adress and now i become reports...hm...i must check this the next few days.

Other Question, how can i do a dashboard with manually Computernames?
When i do a event log dashboard i use:

source="WMI:WinEventLog:" ComputerName="" | stats count count(eval(Type="Warnung")) as warnings count(eval(Type="Fehler")) as errors by host

But we have MAC-Adress as Computername, i see only "FFC00..." "FF00..." and so on, how must i change the search command that i have costum Names for the restults?
FFCC00 = Computer1
FF00 = Computer2 and so on.

greets.