Getting Data In

Enable WMI:LocalNetwork

rgraetz
New Member

Hello,

How to enable WMI:LocalNetwork? Where is the correct config file? Doesn't find anything about the syntax in the wiki.....

thx alot.....

Tags (1)
0 Karma

proctorgeorge
Path Finder

Hello rgraetz,

Here are some assumptions I am making about your question, if these are incorrect then please clarify in your question.

1: That you have the Windows App installed and are using it to gather WMI information.

2: That you are not using deployment clients or light weight forwarders.

If that is the case then in the folder %SPLUNK-INSTALL%\etc\apps\windows\local (ex. C:\Program Files\Splunk\etc\apps\windows\local) on the server you want to monitor there should be a file called wmi.conf that holds configurations for WMI inputs. It's got stanzas like this inside:

 [WMI:FreeDiskSpace] 
 interval = 60
 disabled = 0 
 server = localhost

You want to Add (or un-disable) the LocalNetwork one, which will look something like this:

[WMI:LocalNetwork]
interval = 300
disabled = 0

TL;DR: The correct config file is wmi.conf in the folder %SPLUNK-INSTALL%\etc\apps\windows\local and the syntax is like above 🙂

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...