Hello,
I am currently using Splunk UF 7.2 on a Windows Server, and my UF is configured on D Drive.
I am getting below error message in splunkd.log:
07-29-2024 09:07:25.343 +0100 ERROR ExecProcessor -message from ""D:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: Win32_Service | SELECT Name, Caption, State, Status, StartMode, StartName, PathName Description)
07-29-2024 09:07:25.343 +0100 ERROR ExecProcessor - message from ""D:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: Win32_PerfFormattedData_PerfProc_Process | SELECT Name, PSComputerName, WorkingSetPrivate, IDProcess, PercentProcessorTime)"
$SPLUNK_HOME\etc\system\local\
inputs.conf:
[default]
host = <hostname>
[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0
wmi.conf:
[settings]
initial_backoff = 5
max_backoff = 20
max_retries_at_max_backoff = 2
checkpoint_sync_interval = 2
[WMI:LocalProcesses]
interval = 20
wql = Win32_PerfFormattedData_PerfProc_Process | SELECT Name, PSComputerName, WorkingSetPrivate, IDProcess, PercentProcessorTime
disabled = 0
[WMI:Service]
interval = 86400
wql = Win32_Service | SELECT Name, Caption, State, Status, StartMode, StartName, PathName Description
Can someone please help?
I am not using Splunk Add On For Windows.
The error says it all. The wql parameter needs a valid WQL query to retrieve the data. Yours is not a proper WQL query.
BTW, why are you using WMI? This is one of the worst ways of getting data from Windows.
I tried with the WQL that is there in Splunk App for Windows default. It is giving the same error.
i am using WMI because I want to fetch the near real time resource consumption wrt services running on windows. That information is not coming via Perfmon.
You can use a tool like https://www.nirsoft.net/utils/simple_wmi_view.html to verify your WQL.