Getting Data In

How to configure the universal forwarder to collect System Properties on a Windows Server?

jrhoads
New Member

How can I configure the universal forwarder to collect the hosts system properties?

0 Karma

maciep
Champion

You should be able to use wmi.conf to query whatever WMI classes you'd like (win32_computersystem, win32_operatingsystem, etc).

0 Karma

jrhoads
New Member

If I search the link provided and search for the win32_* items mentioned there is no reference found. Are there example configurations for System Assigned Ram, etc?

0 Karma

maciep
Champion

if you look in the example conf file at the bottom of that page, specifically at the wql settings, you should see how to query wmi. For example:

[WMI:LocalPhysicalDisk]
interval = 1
wql = select Name, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk
disabled = 0
index = wmi_perfmon

If you need to know where in WMI to find the data you want, that's probably going to be all google. For example, the win32_computersystem class has a field for TotalPhysicalMemory. And the win32_physicalmemory class has a field called capacity.

I guess another option is to see if the add-on for windows would work for you too. Maybe that would be easier?

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...