Getting Data In

WMI polling on 64-bit Windows

vaibhavbeohar
Path Finder

Need your help to configure UF in my windows 64 bit machine , have configure UF and getting WMI data but i am unable to get LocalProcesses, have created wmi.conf and following are the configuration

[WMI:LocalPhysicalDisk]
interval = 60
wql = select Name, CurrentDiskQueueLength, DiskBytesPerSec, PercentDiskReadTime,  PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk
index = default
disabled = 0

[WMI:LocalProcesses]
interval = 60
wql = select Name, IDProcess, PrivateBytes, PercentProcessorTime from Win32_PerfFormattedData_PerfProc_Process
index = default
disabled = 0

[WMI:Memory]
interval = 60
wql = select PagesPerSec, AvailableMBytes, CommittedBytes, PercentCommittedBytesInUse from Win32_PerfFormattedData_PerfOS_Memory
index = default
disabled = 0

[WMI:CPUTime]
interval = 60
wql = SELECT PercentProcessorTime,PercentUserTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name="_Total"
index = default
disabled = 0

I am getting every thing except "WMI:LocalProcesses" , i dont understand the cause of this , it is b'cos of i am 64bit machine if so, what configuration have to make to get the data.

Thanks in advance.

Tags (2)
0 Karma

hartfoml
Motivator

When I use the WMI collector below: I get this info"Microsoft Windows Server 2008 R2 Enterprise, Win32_ComputerSystem, 64-bit, 7601"

[WMI:LocalOSInfo]

interval = 21600

disabled = 0

server = localhost

wql = select * from Win32_OperatingSystem

I am collecting the "WMI:LocalProcesses" info on only one process from all my 2008 64bit systems.

Try collecting the "LocalOSInfo" like this (select * from Win32_OperatingSystem
) and see what version your running

If you get the same info I get then try collecting from one process only like this(SELECT Name, PercentProcessorTime FROM Win32_PerfFormattedData_PerfProc_Process WHERE Name = "splunkd")

Hope this helps

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...