Getting Data In

Why isn't WMI class working with Splunk?

jip31
Motivator

hello

I fluently use WMI request with Splunk.

until now, i haven't had any problems.

I have to use these 2 WMI classes, but Splunk is unable to request from them.

Anybody have an idea why this is happening? Are there some restrictions between Splunk and WMI???

[WMI:BatteryFull]
disabled = 0
interval = 30
wql = SELECT * FROM BatteryFullChargedCapacity
index = windows-wmi

[WMI:BatteryStatic]
disabled = 0
interval = 30
wql = SELECT * FROM BatteryStaticData
index = windows-wmi
Tags (2)
0 Karma

hnorvik
Explorer

Taking a chance on answering an old question here since I got stuck with the same issue..... 

It now worked fine on my Universal forwarder. You just need to add this line to wmi.conf:

namespace = root\wmi

I also noticed that when doing the splunk cmd test query you need to pay attention to the case of -namespace

 -Namespace triggers an error while -namespace works fine.

0 Karma

jip31
Motivator

Dont you think its because the WMI namespace that Splunk Enterprise accesses (most commonly Root\CIMV2) must have proper permissions. These permissions must be set manually on each host in your enterprise, as there is no global WMI security. ?

0 Karma

jip31
Motivator

I checked the log and i have this :
10-06-2018 06:59:44.210 +0200 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Specified class is not valid." HRESULT=80041010) (root\cimv2: SELECT * FROM BatteryFullChargedCapacity)

is thre omething to do for doing valid a wmi class??

0 Karma

jip31
Motivator

nobody has an idea please??

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...