Why is "WinHostMon://Service not working

[Alan_Chan]

Hi all,

I am experiencing an issue with the Splunk WinHostInfo input. It is not working after being deployed to the universal forwarder, whereas the other logs from the same device are successfully received. Does anyone have any idea or suggestions on how to resolve this?

[danielcj]

Hello @Alan_Chan ,

Could you please share the configuration of the inputs.conf file for the WinHostMon://Service input?

Please make sure that the disabled=0 is configured for this input and also that a restart in the splunk service was done after the changes on the inputs.conf file. Also, it is recommended to execute a btool command to make sure that this configuration is with the correct precedence:

splunk btool inputs list --debug

Thanks.

[Alan_Chan]

Hi @danielcj,

Here are the configuration:
[WinHostMon://Service]
interval = 600
disabled = 0
type = Service
index = windows

After execute "splunk list inputstatus" on the UF, I could not found splunk-winhostinfo.exe (WinHostMon://Service) running