I have Splunk App for Infrastructure installed on Splunk Cloud and have already onboarded windows details using easy install script but no where I can see Services data to perform real time monitoring of services.msc
Thanks but I already carried out both the approaches and both are not useful when it comes to SAI.
Be it winhostmon or wmi, once you have configured, it will forward the events to SAI, but you won't find any alerting option on such event based metrics, while rest all metrics of SAI shows alerting option. Also it will be attached to SAI as a count query which is not at all useful as it neither shows service name nor if its up or down.
And now the second cons is wrt wmi. In general let say we are not doing it for SAI but to get the service status and apply alerting using searh query or to create dashboard/reports; in that case too Wmi cons are more impacting than its pros. No doubt wmi provides flexibility to choose the specific services but it won't extract complete name of Services (be it DisplayName or Name field) but will only extract first name
So neither of the approach is useful when it comes to SAI.