All Apps and Add-ons

Why is "WinHostMon://Service not working

Alan_Chan
Loves-to-Learn Everything

Hi all,

I am experiencing an issue with the Splunk WinHostInfo input. It is not working after being deployed to the universal forwarder, whereas the other logs from the same device are successfully received. Does anyone have any idea or suggestions on how to resolve this?

Labels (1)
Tags (1)
0 Karma

danielcj
Communicator

Hello @Alan_Chan ,

Could you please share the configuration of the inputs.conf file for the WinHostMon://Service input?

Please make sure that the disabled=0 is configured for this input and also that a restart in the splunk service was done after the changes on the inputs.conf file. Also, it is recommended to execute a btool command to make sure that this configuration is with the correct precedence:

splunk btool inputs list --debug

Thanks.

0 Karma

Alan_Chan
Loves-to-Learn Everything

Hi @danielcj,

Here are the configuration:
[WinHostMon://Service]
interval = 600
disabled = 0
type = Service
index = windows

After execute "splunk list inputstatus" on the UF, I could not found splunk-winhostinfo.exe (WinHostMon://Service) running

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...