Getting Data In

Forwarding remote WMI information

fnsbsd
New Member

I need to configure a universal forwarder to remotely collect WMI information (eventlogs) from various Windows hosts, and then forward that information to my indexer. I have the universal forwarder up and running, and it is successfully forwarding local information to my indexer.

I believe I need to write a WMI.conf file, but I don't know what to put in it. Can someone post an example of what it should look like, or tell me if I should be using a light forwarder instead?

Thank you.

0 Karma

MarioM
Motivator

if you download to your UF the Splunk for Windows technology add-on it has, in default folder, a wmi.conf with examples ie:

[WMI:LocalSecurity]
interval = 10
event_log_file = Security
index = default
disabled = 0

[WMI:LocalProcesses]
interval = 30
wql = SELECT Name, IDProcess, PrivateBytes, PercentProcessorTime FROM Win32_PerfFormattedData_PerfProc_Process
index = default
disabled = 0
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...