Getting Data In

Enable WMI:LocalNetwork

rgraetz
New Member

Hello,

How to enable WMI:LocalNetwork? Where is the correct config file? Doesn't find anything about the syntax in the wiki.....

thx alot.....

Tags (1)
0 Karma

proctorgeorge
Path Finder

Hello rgraetz,

Here are some assumptions I am making about your question, if these are incorrect then please clarify in your question.

1: That you have the Windows App installed and are using it to gather WMI information.

2: That you are not using deployment clients or light weight forwarders.

If that is the case then in the folder %SPLUNK-INSTALL%\etc\apps\windows\local (ex. C:\Program Files\Splunk\etc\apps\windows\local) on the server you want to monitor there should be a file called wmi.conf that holds configurations for WMI inputs. It's got stanzas like this inside:

 [WMI:FreeDiskSpace] 
 interval = 60
 disabled = 0 
 server = localhost

You want to Add (or un-disable) the LocalNetwork one, which will look something like this:

[WMI:LocalNetwork]
interval = 300
disabled = 0

TL;DR: The correct config file is wmi.conf in the folder %SPLUNK-INSTALL%\etc\apps\windows\local and the syntax is like above 🙂

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...