Getting Data In

How to resolve an "Invalid key in stanza [WMI:Patching]" error that occurs after defining a WMI input on universal forwarder?

FritzWittwer
Contributor

I have a WMI Input defined on a universal forwarder and I get the following error while starting Splunk, and of course nothing gets indexed from this input

**Checking prerequisites...
        Checking mgmt port [8089]: open
        Checking conf files for problems...
                Invalid key in stanza [WMI:Patching] in C:\Program Files\SplunkUniversalForwarder\etc\apps\its-440-Splunk_TA_windows_6_4_2\local\inputs.conf, line 292: wql  (value:  select 'Description'', HotfixID', 'InstalledOn' from 'Win32_QuickFixEngineering').**

I did not find any hints in the documentation, i also tried an example WQL query from the docs and got the same error.
I try the following Input:

[WMI:Patching]
interval = 10
wql = select Description, HotfixID, InstalledOn from Win32_QuickFixEngineering
disabled = 0
index = testing

the search is working:

C:\Program Files\SplunkUniversalForwarder\bin>splunk-wmi.exe -wql "select Description, HotfixID, InstalledOn from Win32_QuickFixEngineering"

***SPLUNK*** index= source="WMI:unspecified" sourcetype="WMI:unspecified"

---splunk-wmi-end-of-event---
20161101223526.526996
Description=Update
HotFixID=KB3176936
InstalledOn=8/25/2016
wmi_type=unspecified

---splunk-wmi-end-of-event---
0 Karma
1 Solution

bshuler_splunk
Splunk Employee
Splunk Employee

The docs for this are here: http://docs.splunk.com/Documentation/Splunk/6.3.5/Admin/Wmiconf

It looks like you are doing it right, except you need those lines in a wmi.conf, not an inputs.conf

View solution in original post

0 Karma

bshuler_splunk
Splunk Employee
Splunk Employee

The docs for this are here: http://docs.splunk.com/Documentation/Splunk/6.3.5/Admin/Wmiconf

It looks like you are doing it right, except you need those lines in a wmi.conf, not an inputs.conf

0 Karma

FritzWittwer
Contributor

upps, stupid me, thanks for pointing me towards the solution

0 Karma

skoelpin
SplunkTrust
SplunkTrust

A potential problem can be the space between "Program Files"..

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...