Getting Data In

How to configure the universal forwarder to collect System Properties on a Windows Server?

jrhoads
New Member

How can I configure the universal forwarder to collect the hosts system properties?

0 Karma

maciep
Champion

You should be able to use wmi.conf to query whatever WMI classes you'd like (win32_computersystem, win32_operatingsystem, etc).

0 Karma

jrhoads
New Member

If I search the link provided and search for the win32_* items mentioned there is no reference found. Are there example configurations for System Assigned Ram, etc?

0 Karma

maciep
Champion

if you look in the example conf file at the bottom of that page, specifically at the wql settings, you should see how to query wmi. For example:

[WMI:LocalPhysicalDisk]
interval = 1
wql = select Name, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk
disabled = 0
index = wmi_perfmon

If you need to know where in WMI to find the data you want, that's probably going to be all google. For example, the win32_computersystem class has a field for TotalPhysicalMemory. And the win32_physicalmemory class has a field called capacity.

I guess another option is to see if the add-on for windows would work for you too. Maybe that would be easier?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...