Getting Data In

Windows WMI configuration

phoenixsecure
Engager

Hi,

Is there a way to configure how Splunk get the data from WMI for event logs, ex: how often Splunk check the host for logs, when, bandwith max etc.

Thanks.

Tags (2)
1 Solution

the_wolverine
Champion

You can configure the polling interval when configuring your WMI input via UI or by editing the wmi.conf file directly. Read the Monitor WMI data section of the documentation for more details about what is configurable and examples:

View solution in original post

Ledio_Ago
Splunk Employee
Splunk Employee

The collection of Windows Event Logs via WMI is done in a interval, every 10 seconds by default. This is configurable.

Currently there is not limit on the bandwidth, but that's a good idea and worth looking into it.

Thank you!

0 Karma

the_wolverine
Champion

You can configure the polling interval when configuring your WMI input via UI or by editing the wmi.conf file directly. Read the Monitor WMI data section of the documentation for more details about what is configurable and examples:

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...