send WMI data to Linux Splunk?

[tedder]

I'm using a Windows Splunk server to collect WMI data. How can I use that to send data to my main Splunk installation, which is Linux? I'm looking for the best practice- what's the easiest way to do this? Install a lightweight forwarder on every Windows server?

[jrodman · Accepted solution]

WMI is specifically a remote-and-local monitoring interface. Therefor, with the right domain permissions wizardry, a single WMI-enabled splunk can monitor a significant number of other workstations.

That's one way to do things.

Note that WMI remote polling isn't terribly optimized (in the windows subsystem) so remote monitoring several hundreds of hosts is not usually possible, but 60-100 or so may be quite achievable.

Some prefer the lightweight forwarder instance on the specific nodes approach. It involves more effort in the installation and config management side of things, but less domain permissions expertise, and less having to evaluate the limits of remote WMI in your environment.

If your wmi data is really the eventlog information, there's a variety of other options, such as forwarding the data within the windows event log remoting facility (newer versions of windows only). I don't hear this is fun to do, but it may give you other benefits depending upon your goals for hte data.