Getting Data In

send WMI data to Linux Splunk?

tedder
Communicator

I'm using a Windows Splunk server to collect WMI data. How can I use that to send data to my main Splunk installation, which is Linux? I'm looking for the best practice- what's the easiest way to do this? Install a lightweight forwarder on every Windows server?

0 Karma
1 Solution

jrodman
Splunk Employee
Splunk Employee

WMI is specifically a remote-and-local monitoring interface. Therefor, with the right domain permissions wizardry, a single WMI-enabled splunk can monitor a significant number of other workstations.

That's one way to do things.

Note that WMI remote polling isn't terribly optimized (in the windows subsystem) so remote monitoring several hundreds of hosts is not usually possible, but 60-100 or so may be quite achievable.

Some prefer the lightweight forwarder instance on the specific nodes approach. It involves more effort in the installation and config management side of things, but less domain permissions expertise, and less having to evaluate the limits of remote WMI in your environment.

If your wmi data is really the eventlog information, there's a variety of other options, such as forwarding the data within the windows event log remoting facility (newer versions of windows only). I don't hear this is fun to do, but it may give you other benefits depending upon your goals for hte data.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

WMI is specifically a remote-and-local monitoring interface. Therefor, with the right domain permissions wizardry, a single WMI-enabled splunk can monitor a significant number of other workstations.

That's one way to do things.

Note that WMI remote polling isn't terribly optimized (in the windows subsystem) so remote monitoring several hundreds of hosts is not usually possible, but 60-100 or so may be quite achievable.

Some prefer the lightweight forwarder instance on the specific nodes approach. It involves more effort in the installation and config management side of things, but less domain permissions expertise, and less having to evaluate the limits of remote WMI in your environment.

If your wmi data is really the eventlog information, there's a variety of other options, such as forwarding the data within the windows event log remoting facility (newer versions of windows only). I don't hear this is fun to do, but it may give you other benefits depending upon your goals for hte data.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!