Getting Data In

Remote Eventlog with wmi generates high CPU

CerielTjuh
Path Finder

Hi there,

I know that the best practice for high usage systems is a Splunk Forwarder but due to easy management my system administrators don't want any Splunk software on the machines and want to use WMI polling.

WMIprvse.exe takes up 20% of CPU on my Exchange server as soon as i turn on the Remote Eventlog polling. Is there a way to limit this or change this behaviour?

Thanks in advance!

Tags (1)
0 Karma
1 Solution

CerielTjuh
Path Finder

I have found an answer to all my questions.
Splunk generates a lot of CPU time on machines when polling with WMI.
This is not an issue at all, if a user or the system requires CPU time, the WMI service is suppressed and releases the CPU. When the process finishes and WMI gets CPU time all the eventlogs are collected and send to the central Splunk server.

You can check this out your self by running CPU Burn-in on the target machine (twice for a dual core machine).

View solution in original post

0 Karma

atx876
Explorer

We are trying to do the same, can you provide us some documentation on how you setup WMI? We are trying to collect from multiple windows clients joined to different DC. I cannot seem to find how i can pass various passwords via the WMI scripted inputs.

0 Karma

CerielTjuh
Path Finder

I have found an answer to all my questions.
Splunk generates a lot of CPU time on machines when polling with WMI.
This is not an issue at all, if a user or the system requires CPU time, the WMI service is suppressed and releases the CPU. When the process finishes and WMI gets CPU time all the eventlogs are collected and send to the central Splunk server.

You can check this out your self by running CPU Burn-in on the target machine (twice for a dual core machine).

0 Karma

CerielTjuh
Path Finder

As extra information:

The high CPU is caused by the Security Eventlog, my thoughts are to filter the events when querying for them, is that possible?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...