Getting Data In

Windows WMI configuration

phoenixsecure
Engager

Hi,

Is there a way to configure how Splunk get the data from WMI for event logs, ex: how often Splunk check the host for logs, when, bandwith max etc.

Thanks.

Tags (2)
1 Solution

the_wolverine
Champion

You can configure the polling interval when configuring your WMI input via UI or by editing the wmi.conf file directly. Read the Monitor WMI data section of the documentation for more details about what is configurable and examples:

View solution in original post

Ledio_Ago
Splunk Employee
Splunk Employee

The collection of Windows Event Logs via WMI is done in a interval, every 10 seconds by default. This is configurable.

Currently there is not limit on the bandwidth, but that's a good idea and worth looking into it.

Thank you!

0 Karma

the_wolverine
Champion

You can configure the polling interval when configuring your WMI input via UI or by editing the wmi.conf file directly. Read the Monitor WMI data section of the documentation for more details about what is configurable and examples:

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...