Forwarding remote WMI information

[fnsbsd]

I need to configure a universal forwarder to remotely collect WMI information (eventlogs) from various Windows hosts, and then forward that information to my indexer. I have the universal forwarder up and running, and it is successfully forwarding local information to my indexer.

I believe I need to write a WMI.conf file, but I don't know what to put in it. Can someone post an example of what it should look like, or tell me if I should be using a light forwarder instead?

Thank you.

[MarioM]

if you download to your UF the Splunk for Windows technology add-on it has, in default folder, a wmi.conf with examples ie:

[WMI:LocalSecurity]
interval = 10
event_log_file = Security
index = default
disabled = 0

[WMI:LocalProcesses]
interval = 30
wql = SELECT Name, IDProcess, PrivateBytes, PercentProcessorTime FROM Win32_PerfFormattedData_PerfProc_Process
index = default
disabled = 0