Why isn't WMI class working with Splunk?

[jip31]

hello

I fluently use WMI request with Splunk.

until now, i haven't had any problems.

I have to use these 2 WMI classes, but Splunk is unable to request from them.

Anybody have an idea why this is happening? Are there some restrictions between Splunk and WMI???

[WMI:BatteryFull]
disabled = 0
interval = 30
wql = SELECT * FROM BatteryFullChargedCapacity
index = windows-wmi

[WMI:BatteryStatic]
disabled = 0
interval = 30
wql = SELECT * FROM BatteryStaticData
index = windows-wmi

[hnorvik]

Taking a chance on answering an old question here since I got stuck with the same issue..... 

It now worked fine on my Universal forwarder. You just need to add this line to wmi.conf:

namespace = root\wmi

I also noticed that when doing the splunk cmd test query you need to pay attention to the case of -namespace

 -Namespace triggers an error while -namespace works fine.

[jip31]

Dont you think its because the WMI namespace that Splunk Enterprise accesses (most commonly Root\CIMV2) must have proper permissions. These permissions must be set manually on each host in your enterprise, as there is no global WMI security. ?

[jip31]

I checked the log and i have this :
10-06-2018 06:59:44.210 +0200 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Specified class is not valid." HRESULT=80041010) (root\cimv2: SELECT * FROM BatteryFullChargedCapacity)

is thre omething to do for doing valid a wmi class??

[jip31]

nobody has an idea please??