Getting Data In

How does the connection process work when querying a large number of WMI hosts for statistics (not eventlogs)

Michael_Wilde
Splunk Employee
Splunk Employee

If have 100 desktops i want to collect a few statistics from.. say every 30s... does Splunk make 100 queries every 30s or is there some staggering going on?

Would there be a number of WMI queries that would create a problem for a Splunk server.

It should be noted, that i am not collecting EventLogs--specifically Network Utilization stats on the internal network.

Tags (2)

Ledio_Ago
Splunk Employee
Splunk Employee

Each WMI query will open a dedicated connection to the WMI framework to the target machine, and that connection will persisted for the life of the process or the life of the comm object. At this point we don't recycle the connections and we have time scheduled to go back and optimize this further.

Given this, there are obvious limitations to how many connections can we keep opened and I can't give an exact number to how many, but it is into the hundreds and this will depend on the available resources in the target machine.

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...