Getting Data In

Splunk WMI on Universal Forwarder

anshu2812
Explorer
  1. I am writing a WQL on my universal forwarder to read data from my BizTalk server. I have configured my wmi.conf as below –

[WMI:MSBTSHostInstance]
disabled = 0
wql = SELECT * FROM MSBTS_HostInstance
namespace = root\MicrosoftBizTalkServer
index = temp_index
interval = 30
But I keep getting this error in splunkd.log file - Error occurred while trying to retrieve results from a WMI query (error="FormatMessage was unable to decode error (2148735236), (0x80131904)"

HRESULT=80131904) (root\MicrosoftBizTalkServer: SELECT * FROM MSBTS_HostInstance)

            However if I run the same command from command line in SPLUNK_HOME\bin folder (command – splunk cmd splunk-wmi.exe –WQL “SELECT * FROM MSBTS_HostInstance” –namespace root\MicrosoftBizTalkServer) it gives 
           me the correct result. I tried restarting the WMI service adding debug modifying log.cfg and log-cmdline-debug files but no luck. Wbemtest also lists down all classes in the namespace. [I saw all these 
           troubleshooting steps in the link http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/TroubleshootingWMI] . Splunk UF is configured as local system account, I presume that should not be 
           an issue as it works in command line. 

Can anyone please provide some pointers as to what is going on?

Tags (1)
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

You mentioned that the forwarder is running as a local system account. Is the UF on the same device as the BizTalk server? If not, it seems likely that it's a permissions problem.

Can you (as a test) run the UF under the same account that you used to run the query from the CLI?

View solution in original post

anshu2812
Explorer

Perfectly said sbrant..it was the permission issue with local system account not being able to access the SQL server. I tried creating a batch file and running under splunk local system and it detailed the permission issue in splunkd.log. Thanks!!!

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

You mentioned that the forwarder is running as a local system account. Is the UF on the same device as the BizTalk server? If not, it seems likely that it's a permissions problem.

Can you (as a test) run the UF under the same account that you used to run the query from the CLI?

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...