Getting Data In

send WMI data to Linux Splunk?

tedder
Communicator

I'm using a Windows Splunk server to collect WMI data. How can I use that to send data to my main Splunk installation, which is Linux? I'm looking for the best practice- what's the easiest way to do this? Install a lightweight forwarder on every Windows server?

0 Karma
1 Solution

jrodman
Splunk Employee
Splunk Employee

WMI is specifically a remote-and-local monitoring interface. Therefor, with the right domain permissions wizardry, a single WMI-enabled splunk can monitor a significant number of other workstations.

That's one way to do things.

Note that WMI remote polling isn't terribly optimized (in the windows subsystem) so remote monitoring several hundreds of hosts is not usually possible, but 60-100 or so may be quite achievable.

Some prefer the lightweight forwarder instance on the specific nodes approach. It involves more effort in the installation and config management side of things, but less domain permissions expertise, and less having to evaluate the limits of remote WMI in your environment.

If your wmi data is really the eventlog information, there's a variety of other options, such as forwarding the data within the windows event log remoting facility (newer versions of windows only). I don't hear this is fun to do, but it may give you other benefits depending upon your goals for hte data.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

WMI is specifically a remote-and-local monitoring interface. Therefor, with the right domain permissions wizardry, a single WMI-enabled splunk can monitor a significant number of other workstations.

That's one way to do things.

Note that WMI remote polling isn't terribly optimized (in the windows subsystem) so remote monitoring several hundreds of hosts is not usually possible, but 60-100 or so may be quite achievable.

Some prefer the lightweight forwarder instance on the specific nodes approach. It involves more effort in the installation and config management side of things, but less domain permissions expertise, and less having to evaluate the limits of remote WMI in your environment.

If your wmi data is really the eventlog information, there's a variety of other options, such as forwarding the data within the windows event log remoting facility (newer versions of windows only). I don't hear this is fun to do, but it may give you other benefits depending upon your goals for hte data.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...