Getting Data In

Syntactical Error in WQL

sarvesh_11
Communicator

Hello,
I am currently using Splunk UF 7.2 on a Windows Server, and my UF is configured on D Drive.

I am getting below error message in splunkd.log:

07-29-2024 09:07:25.343 +0100 ERROR ExecProcessor -message from ""D:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: Win32_Service | SELECT Name, Caption, State, Status, StartMode, StartName, PathName Description)


07-29-2024 09:07:25.343 +0100 ERROR ExecProcessor - message from ""D:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: Win32_PerfFormattedData_PerfProc_Process | SELECT Name, PSComputerName, WorkingSetPrivate, IDProcess, PercentProcessorTime)"

 

$SPLUNK_HOME\etc\system\local\

inputs.conf:

[default]
host = <hostname>

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

 

wmi.conf:

[settings]
initial_backoff = 5
max_backoff = 20
max_retries_at_max_backoff = 2
checkpoint_sync_interval = 2

[WMI:LocalProcesses]
interval = 20
wql = Win32_PerfFormattedData_PerfProc_Process | SELECT Name, PSComputerName, WorkingSetPrivate, IDProcess, PercentProcessorTime
disabled = 0

[WMI:Service]
interval = 86400
wql = Win32_Service | SELECT Name, Caption, State, Status, StartMode, StartName, PathName Description

 

Can someone please help?
I am not using Splunk Add On For Windows.

Labels (2)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

The error says it all. The wql parameter needs a valid WQL query to retrieve the data. Yours is not a proper WQL query.

BTW, why are you using WMI? This is one of the worst ways of getting data from Windows.

0 Karma

sarvesh_11
Communicator

I tried with the WQL that is there in Splunk App for Windows default. It is giving the same error.

 

i am using WMI because I want to fetch the near real time resource consumption wrt services running on windows. That information is not coming via Perfmon.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can use a tool like https://www.nirsoft.net/utils/simple_wmi_view.html to verify your WQL.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...