All Apps and Add-ons

How to fetch Windows Services details using Splunk App For Infrastructure?


Dear Splunkers,

I have Splunk App for Infrastructure installed on Splunk Cloud and have already onboarded windows details using easy install script but no where I can see Services data to perform real time monitoring of services.msc

Could you please guide here?

0 Karma


Hi @skrajkumar_splunk
Thanks but I already carried out both the approaches and both are not useful when it comes to SAI.
Be it winhostmon or wmi, once you have configured, it will forward the events to SAI, but you won't find any alerting option on such event based metrics, while rest all metrics of SAI shows alerting option. Also it will be attached to SAI as a count query which is not at all useful as it neither shows service name nor if its up or down.

And now the second cons is wrt wmi. In general let say we are not doing it for SAI but to get the service status and apply alerting using searh query or to create dashboard/reports; in that case too Wmi cons are more impacting than its pros. No doubt wmi provides flexibility to choose the specific services but it won't extract complete name of Services (be it DisplayName or Name field) but will only extract first name

So neither of the approach is useful when it comes to SAI.


0 Karma

Splunk Employee
Splunk Employee

Hi Kundanbbisht

I believe easy install script doesn't enable service monitoring by default. If you want to monitor windows service kindly include below winhostmon stanza in your inputs.conf file

type = service
interval = 300
index = default

If you wish to further narrow down or filter your data on services you can even opt a wql query to ingest filtered data. For that you have to go with wmi.conf like below.

interval = 60
disabled = 0
index = default
wql = select Name, ProcessId, Caption, DisplayName, State, Status, StartName, SystemName from Win32_Service

You can alter this WQL query as per your necessity. Hope this helps.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...