Getting Data In

Splunk WMI on Universal Forwarder

anshu2812
Explorer
  1. I am writing a WQL on my universal forwarder to read data from my BizTalk server. I have configured my wmi.conf as below –

[WMI:MSBTSHostInstance]
disabled = 0
wql = SELECT * FROM MSBTS_HostInstance
namespace = root\MicrosoftBizTalkServer
index = temp_index
interval = 30
But I keep getting this error in splunkd.log file - Error occurred while trying to retrieve results from a WMI query (error="FormatMessage was unable to decode error (2148735236), (0x80131904)"

HRESULT=80131904) (root\MicrosoftBizTalkServer: SELECT * FROM MSBTS_HostInstance)

            However if I run the same command from command line in SPLUNK_HOME\bin folder (command – splunk cmd splunk-wmi.exe –WQL “SELECT * FROM MSBTS_HostInstance” –namespace root\MicrosoftBizTalkServer) it gives 
           me the correct result. I tried restarting the WMI service adding debug modifying log.cfg and log-cmdline-debug files but no luck. Wbemtest also lists down all classes in the namespace. [I saw all these 
           troubleshooting steps in the link http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/TroubleshootingWMI] . Splunk UF is configured as local system account, I presume that should not be 
           an issue as it works in command line. 

Can anyone please provide some pointers as to what is going on?

Tags (1)
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

You mentioned that the forwarder is running as a local system account. Is the UF on the same device as the BizTalk server? If not, it seems likely that it's a permissions problem.

Can you (as a test) run the UF under the same account that you used to run the query from the CLI?

View solution in original post

anshu2812
Explorer

Perfectly said sbrant..it was the permission issue with local system account not being able to access the SQL server. I tried creating a batch file and running under splunk local system and it detailed the permission issue in splunkd.log. Thanks!!!

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

You mentioned that the forwarder is running as a local system account. Is the UF on the same device as the BizTalk server? If not, it seems likely that it's a permissions problem.

Can you (as a test) run the UF under the same account that you used to run the query from the CLI?

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...