Getting Data In

How to configure the universal forwarder to collect System Properties on a Windows Server?

jrhoads
New Member

How can I configure the universal forwarder to collect the hosts system properties?

0 Karma

maciep
Champion

You should be able to use wmi.conf to query whatever WMI classes you'd like (win32_computersystem, win32_operatingsystem, etc).

0 Karma

jrhoads
New Member

If I search the link provided and search for the win32_* items mentioned there is no reference found. Are there example configurations for System Assigned Ram, etc?

0 Karma

maciep
Champion

if you look in the example conf file at the bottom of that page, specifically at the wql settings, you should see how to query wmi. For example:

[WMI:LocalPhysicalDisk]
interval = 1
wql = select Name, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk
disabled = 0
index = wmi_perfmon

If you need to know where in WMI to find the data you want, that's probably going to be all google. For example, the win32_computersystem class has a field for TotalPhysicalMemory. And the win32_physicalmemory class has a field called capacity.

I guess another option is to see if the add-on for windows would work for you too. Maybe that would be easier?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...