- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- WMI.conf and Arrays: How do I instruct Splunk to r...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm pulling various Win32 classes via WMI.conf and am running into an issue when the value is an array. Below is an example of pulling IP-enabled adapters so that we have a record of IP, subnet, DNS, etc. However, the IPAddress is stored in an array IPAddress={192.168.1.1} and when WMI.conf tries to collect the information, it results in the value "unknown variant result type 8200".
How do I instruct Splunk to report the array correctly?
[WMI:NICInfo]
server = localhost
wql = Select * from Win32_NetworkAdapterConfiguration WHERE IPEnabled = True
interval = 86400
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would recommend a support case.
Splunk uses the WMI C/C++ API's to access WMI data. Those API's return results that get packaged up into an opaque object called a VARIANT. There are different types of VARIANTs for Strings, Integers, Arrays, etc. The application calling WMI must have logic to extract the data it wants out of each type of VARIANT it supports.
The information you provide here (cross-referenced with Google) suggests that a VARIANT of type 8200 is an array. It is possible that the code in Splunk that calls this API does not have the extraction logic for arrays. Such support (as a multi-valued field, perhaps) if it does not exist could be either a defect or an enhancement. Either way, a support case is the right place to start.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the outcome of this? I'm having the exact same issue now. Have you found a workaround?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would recommend a support case.
Splunk uses the WMI C/C++ API's to access WMI data. Those API's return results that get packaged up into an opaque object called a VARIANT. There are different types of VARIANTs for Strings, Integers, Arrays, etc. The application calling WMI must have logic to extract the data it wants out of each type of VARIANT it supports.
The information you provide here (cross-referenced with Google) suggests that a VARIANT of type 8200 is an array. It is possible that the code in Splunk that calls this API does not have the extraction logic for arrays. Such support (as a multi-valued field, perhaps) if it does not exist could be either a defect or an enhancement. Either way, a support case is the right place to start.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks dwaddle.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so, 5 years later this still doesn't seem to work... any news?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm also curious about this. Any update?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Reporting in from the future, OVER TEN YEARS LATER.
It still doesn't work.
@dwaddle since, it has been over a decade since support tickets have been put in for this issue, any other resolutions?
Routing logs with Splunk OTel Collector for Kubernetes
Welcome to the Splunk Community!
Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM
