Getting Data In

send WMI data to Linux Splunk?

tedder
Communicator

I'm using a Windows Splunk server to collect WMI data. How can I use that to send data to my main Splunk installation, which is Linux? I'm looking for the best practice- what's the easiest way to do this? Install a lightweight forwarder on every Windows server?

0 Karma
1 Solution

jrodman
Splunk Employee
Splunk Employee

WMI is specifically a remote-and-local monitoring interface. Therefor, with the right domain permissions wizardry, a single WMI-enabled splunk can monitor a significant number of other workstations.

That's one way to do things.

Note that WMI remote polling isn't terribly optimized (in the windows subsystem) so remote monitoring several hundreds of hosts is not usually possible, but 60-100 or so may be quite achievable.

Some prefer the lightweight forwarder instance on the specific nodes approach. It involves more effort in the installation and config management side of things, but less domain permissions expertise, and less having to evaluate the limits of remote WMI in your environment.

If your wmi data is really the eventlog information, there's a variety of other options, such as forwarding the data within the windows event log remoting facility (newer versions of windows only). I don't hear this is fun to do, but it may give you other benefits depending upon your goals for hte data.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

WMI is specifically a remote-and-local monitoring interface. Therefor, with the right domain permissions wizardry, a single WMI-enabled splunk can monitor a significant number of other workstations.

That's one way to do things.

Note that WMI remote polling isn't terribly optimized (in the windows subsystem) so remote monitoring several hundreds of hosts is not usually possible, but 60-100 or so may be quite achievable.

Some prefer the lightweight forwarder instance on the specific nodes approach. It involves more effort in the installation and config management side of things, but less domain permissions expertise, and less having to evaluate the limits of remote WMI in your environment.

If your wmi data is really the eventlog information, there's a variety of other options, such as forwarding the data within the windows event log remoting facility (newer versions of windows only). I don't hear this is fun to do, but it may give you other benefits depending upon your goals for hte data.

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...