How to fetch Windows Services details using Splunk App For Infrastructure?

[bishtk]

Dear Splunkers,

I have Splunk App for Infrastructure installed on Splunk Cloud and have already onboarded windows details using easy install script but no where I can see Services data to perform real time monitoring of services.msc

Could you please guide here?

[bishtk]

Hi @skrajkumar_splunk
Thanks but I already carried out both the approaches and both are not useful when it comes to SAI.
Be it winhostmon or wmi, once you have configured, it will forward the events to SAI, but you won't find any alerting option on such event based metrics, while rest all metrics of SAI shows alerting option. Also it will be attached to SAI as a count query which is not at all useful as it neither shows service name nor if its up or down.

And now the second cons is wrt wmi. In general let say we are not doing it for SAI but to get the service status and apply alerting using searh query or to create dashboard/reports; in that case too Wmi cons are more impacting than its pros. No doubt wmi provides flexibility to choose the specific services but it won't extract complete name of Services (be it DisplayName or Name field) but will only extract first name

So neither of the approach is useful when it comes to SAI.

Thanks,
@kundanbbisht

[skrajkumar_splu]

Hi Kundanbbisht

I believe easy install script doesn't enable service monitoring by default. If you want to monitor windows service kindly include below winhostmon stanza in your inputs.conf file

[WinHostMon://Service]
type = service
interval = 300
index = default

If you wish to further narrow down or filter your data on services you can even opt a wql query to ingest filtered data. For that you have to go with wmi.conf like below.

[WMI:Services]
interval = 60
disabled = 0
index = default
wql = select Name, ProcessId, Caption, DisplayName, State, Status, StartName, SystemName from Win32_Service

You can alter this WQL query as per your necessity. Hope this helps.