WMI - How many remote Windows can a Splunk WMI input support?

[melonman]

Hi

I am planning to monitor many Windows client via WMI interface.
I have one Splunk installed on Windows7.
How many remote Windows can a Splunk WMI input support?
Do we have any estimation calculation about the number of max number of target windows hosts?
10s, 100s, or 1000s windows hosts?

Thanks!

[araitz · Accepted solution]

It depends on how busy the remote hosts are. As a rule of thumb, one Splunk instance (forwarder or indexer) can support the collection of Security Event Logs (the most verbose variety) on between 20 and 50 remote hosts. To scale out collection on more remote hosts, simply add another Splunk instance (forwarder or indexer) to collect another from another 20 to 50 remote hosts. Rinse and repeat.

All that said, I would strongly recomment installing the Splunk Forwarder, a relatively lightweight build of Splunk that has no UI and no indexing, on your hosts rather than using WMI. Beyond better resiliance by collecting Event Logs and other WMI data remotely, you will be able to easily collect and forward other data such as DNS, DHCP, Windows Update, and application logs.