Getting Data In

Getting Error When trying to read windows event logs from am remote machine.

harshavrath
Contributor

HI
I'm getting an error as "Failed to fetch data: In handler 'win-wmi-enum-eventlogs': Unable to get wmi classes from host '...*'. This host may not be reachable or WMI may be misconfigured."

I'm i getting this error because my Splunk is installed as Local User.?

Splunk is installed on Windows Server 2003.

Splunk is installed in an US Machine by my manager I'm remotely logging in & using it.

Tags (3)
0 Karma
1 Solution

wcolgate_splunk
Splunk Employee
Splunk Employee

In order to collect WMI data from the remote machine, the user connecting must have rights on the remote machine. I'm confident that you will need to install splunk as a specific user and then give that user WMI rights on the collection target. In addition, 6.0.x and prior, your specific user will also have to be a member of the local admin group on the machine splunk is installed on.

View solution in original post

wcolgate_splunk
Splunk Employee
Splunk Employee

In order to collect WMI data from the remote machine, the user connecting must have rights on the remote machine. I'm confident that you will need to install splunk as a specific user and then give that user WMI rights on the collection target. In addition, 6.0.x and prior, your specific user will also have to be a member of the local admin group on the machine splunk is installed on.

Get Updates on the Splunk Community!

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...