Capturing SNMP data from local SNMP WMI Provider

[APNelson]

How can I capture WMI data from the local machine in Splunk? The program I am working on has a preexisting tool that used WMI to report data from SNMP devices (UPS, environment monitors, etc) to our NetIQ instance rather than writing it out to a flat file to be read in.

We don't have the budget to modify that tool as part of migrating to Splunk and all the information I've found for monitoring WMI data in Splunk assumes it is from a different machine and correspondingly requires a domain account instead of being able to run as the local service user.

How can I capture data from the local machine using WMI (preferably continuing to install Splunk as the local user)?

ADDITIONAL DETAILS: I have confirmed that the Windows SNMP Service and SNMP WMI Provider are installed on the same machine that the Splunk indexer is running on. Since they're on the same machine, no network traffic should be required.

Thanks.

[sbrant_splunk · Accepted solution]

Take a look at this http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Wmiconf

There is no requirement for the system, that you're collecting WMI info from, to be remote.

[APNelson]

For that part, still in the planning stages. All our other logs we're capturing are either from Windows events or log files so I have them figured out. It's just the SNMP captures I still need to figure out.

[sbrant_splunk]

Yes, Splunk can run as the local system account. Are you having trouble with permissions or still in the planning stages?

[APNelson]

Can Splunk still be run as the local account rather than a domain one when using this if the WMI data is only on the local system?