Getting Data In

Regarding WMI Input Collections, only 24 are displayed in the Splunk GUI?

maverick
Splunk Employee
Splunk Employee

When I go to add new WMI collections it seems there's a limit and the GUI only displays 24 Inputs, even though I've added over 40 or more Inputs.

Why is there a limit to the amount that can be displayed like this and how can I change it?

Tags (3)

I-Man
Communicator

I submitted a case to splunk support regarding this issue. They logged a bug issue SPL-37605 and stated it will be fixed in an upcoming release. They didn't say which release but they now know about it.

beckels
New Member

I'm seeing the same behavior. I have about 50 collections, but the UI only displays 24. I verified that Splunk is still collecting data from the hosts and they are listed in wmi.conf.

0 Karma

Ledio_Ago
Splunk Employee
Splunk Employee

This is probably a bug, if true.

0 Karma

igor
Splunk Employee
Splunk Employee

There should be no limit. Can you check the total number of stanzas across all wmi.conf files under etc\ ? Let's make sure that those inputs were actually created in the first place.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...