Syntactical Error in WQL

[sarvesh_11]

Hello,
I am currently using Splunk UF 7.2 on a Windows Server, and my UF is configured on D Drive.

I am getting below error message in splunkd.log:

07-29-2024 09:07:25.343 +0100 ERROR ExecProcessor -message from ""D:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: Win32_Service | SELECT Name, Caption, State, Status, StartMode, StartName, PathName Description)

07-29-2024 09:07:25.343 +0100 ERROR ExecProcessor - message from ""D:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: Win32_PerfFormattedData_PerfProc_Process | SELECT Name, PSComputerName, WorkingSetPrivate, IDProcess, PercentProcessorTime)"

$SPLUNK_HOME\etc\system\local\

inputs.conf:

[default]
host = <hostname>

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

wmi.conf:

[settings]
initial_backoff = 5
max_backoff = 20
max_retries_at_max_backoff = 2
checkpoint_sync_interval = 2

[WMI:LocalProcesses]
interval = 20
wql = Win32_PerfFormattedData_PerfProc_Process | SELECT Name, PSComputerName, WorkingSetPrivate, IDProcess, PercentProcessorTime
disabled = 0

[WMI:Service]
interval = 86400
wql = Win32_Service | SELECT Name, Caption, State, Status, StartMode, StartName, PathName Description

Can someone please help?
I am not using Splunk Add On For Windows.

[PickleRick]

The error says it all. The wql parameter needs a valid WQL query to retrieve the data. Yours is not a proper WQL query.

BTW, why are you using WMI? This is one of the worst ways of getting data from Windows.

[sarvesh_11]

I tried with the WQL that is there in Splunk App for Windows default. It is giving the same error.

i am using WMI because I want to fetch the near real time resource consumption wrt services running on windows. That information is not coming via Perfmon.

[PickleRick]

You can use a tool like https://www.nirsoft.net/utils/simple_wmi_view.html to verify your WQL.