Windows WMI configuration

[phoenixsecure]

Hi,

Is there a way to configure how Splunk get the data from WMI for event logs, ex: how often Splunk check the host for logs, when, bandwith max etc.

Thanks.

[Ledio_Ago]

The collection of Windows Event Logs via WMI is done in a interval, every 10 seconds by default. This is configurable.

Currently there is not limit on the bandwidth, but that's a good idea and worth looking into it.

Thank you!

[the_wolverine · Accepted solution]

You can configure the polling interval when configuring your WMI input via UI or by editing the wmi.conf file directly. Read the Monitor WMI data section of the documentation for more details about what is configurable and examples: