Archive

4.2 indexing "WMI:LocalNetwork" started without asking

Path Finder

I previously was running 4.1.7 with all WMI inputs disabled.

Now, since upgrading to 4.2, "WMI:LocalNetwork" data indexing has started and logs thousands of events per hour although related data inputs are disabled!!!

How can I fix that irritating problem???

Many Thanks in advance

Mrsplunksta

0 Karma
1 Solution

Path Finder

While this bug is being addressed, I was able to forcibly stop this unwanted indexing by creating the following file then restarting the splunkd service:

$SPLUNK_HOME\etc\system\local\wmi.conf 
[WMI:LocalNetwork] 
disabled = 1 

View solution in original post

Path Finder

While this bug is being addressed, I was able to forcibly stop this unwanted indexing by creating the following file then restarting the splunkd service:

$SPLUNK_HOME\etc\system\local\wmi.conf 
[WMI:LocalNetwork] 
disabled = 1 

View solution in original post