Splunk WMI on Universal Forwarder

[anshu2812]

1. I am writing a WQL on my universal forwarder to read data from my BizTalk server. I have configured my wmi.conf as below –

[WMI:MSBTSHostInstance]
disabled = 0
wql = SELECT * FROM MSBTS_HostInstance
namespace = root\MicrosoftBizTalkServer
index = temp_index
interval = 30
But I keep getting this error in splunkd.log file - Error occurred while trying to retrieve results from a WMI query (error="FormatMessage was unable to decode error (2148735236), (0x80131904)"

HRESULT=80131904) (root\MicrosoftBizTalkServer: SELECT * FROM MSBTS_HostInstance)

            However if I run the same command from command line in SPLUNK_HOME\bin folder (command – splunk cmd splunk-wmi.exe –WQL “SELECT * FROM MSBTS_HostInstance” –namespace root\MicrosoftBizTalkServer) it gives 
           me the correct result. I tried restarting the WMI service adding debug modifying log.cfg and log-cmdline-debug files but no luck. Wbemtest also lists down all classes in the namespace. [I saw all these 
           troubleshooting steps in the link http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/TroubleshootingWMI] . Splunk UF is configured as local system account, I presume that should not be 
           an issue as it works in command line. 

Can anyone please provide some pointers as to what is going on?

[anshu2812]

Perfectly said sbrant..it was the permission issue with local system account not being able to access the SQL server. I tried creating a batch file and running under splunk local system and it detailed the permission issue in splunkd.log. Thanks!!!

[sbrant_splunk · Accepted solution]

You mentioned that the forwarder is running as a local system account. Is the UF on the same device as the BizTalk server? If not, it seems likely that it's a permissions problem.

Can you (as a test) run the UF under the same account that you used to run the query from the CLI?