Why not all Windows Classes show up in WMI "available classes"?

[elusive]

I go to "Manager » Data inputs » WMI data collections » Add New" and enter the host name under "Select target host". I don't see all the classes that I want to select. Why?

[elusive]

The above information is true for older Splunk version, however, with 4.2.x and 4.3.x Win32_PerfFormattedData_* are filtered and will not show up in wmi Splunk Web. If you wish to monitor, it needs to be added manually directly in wmi.conf and restart Splunk.

[elusive]

Any classes with a Win32_PerfFormattedData_* prefix will show up in the list. Other classes that does not have Win32_PerfFormattedData_* prefix will not show up in the available classes list.

If you wish to index other than prefixed Win32_PerfFormattedData_* you can enter it manually directly into wmi.conf.

When collecting WMI events make sure that you are able to query in wbemtest using wql as the account who is starting up Splunk services