How to pull logs using WMI with a Splunk universal forwarder?

[rishabhey2016]

In reference to the following link:
https://answers.splunk.com/answers/26743/can-i-index-wmi-from-a-splunk-instance-running-on-linux.htm...
I want to know that How to pulls log using WMI by Splunk universal forwarder?

[javiergn]

I'm guessing you installed the UF on Windows therefore you have several ways to do this.
My preferred one would be to use a powershell input and collect WMI this way.
Example:

inputs.conf
Windows 8 and 2012 using Get-CimInstance

[powershell://CollectProcessInfoFromWmi]
script = Get-CimInstance Win32_Process | Select-Object Field1, Field2, Field3
schedule = 0 */5 * ? * *
sourcetype = Windows:MyWmiData

PRE Windows 8 and 2012 using Get-WmiObject

[powershell://CollectProcessInfoFromWmi]
script = Get-WmiObject -Class Win32_Process | Select-Object Field1, Field2, Field3
schedule = 0 */5 * ? * *
sourcetype = Windows:MyWmiData

See the following links for more info:

http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/MonitorWindowsdatawithPowerShellscripts
https://technet.microsoft.com/en-us/library/hh849824.aspx
https://technet.microsoft.com/en-us/library/jj590758(v=wps.630).aspx

[javiergn]

Hi, did you get this working at all?