Getting Data In

Forwarding remote WMI information

fnsbsd
New Member

I need to configure a universal forwarder to remotely collect WMI information (eventlogs) from various Windows hosts, and then forward that information to my indexer. I have the universal forwarder up and running, and it is successfully forwarding local information to my indexer.

I believe I need to write a WMI.conf file, but I don't know what to put in it. Can someone post an example of what it should look like, or tell me if I should be using a light forwarder instead?

Thank you.

0 Karma

MarioM
Motivator

if you download to your UF the Splunk for Windows technology add-on it has, in default folder, a wmi.conf with examples ie:

[WMI:LocalSecurity]
interval = 10
event_log_file = Security
index = default
disabled = 0

[WMI:LocalProcesses]
interval = 30
wql = SELECT Name, IDProcess, PrivateBytes, PercentProcessorTime FROM Win32_PerfFormattedData_PerfProc_Process
index = default
disabled = 0
0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...