Getting Data In

windows logs

kovacez
Engager

Hello everybody,
I am really newbie @splunk. please bare with me

I downloaded windows app. I am trying to configure splunk to monitor windows server. So i am going through the wizard, clicked on Get remote event logs via WMI > specified the host and clicked on tab "find logs" and the search returns :
Failed to fetch data: In handler 'win-wmi-enum-eventlogs': Unable to get wmi classes from host '10.1.6.19'. This host may not be reachable or WMI may be misconfigured.

Any ideas why? If i should configure the rights to the windows servers, where that would be? I checked the forums and documentation and could not find the answer
thx

Tags (1)
0 Karma

jacksamson
New Member

Ensure the SplunkForwarder service Log On is a Domain Admin account.

Run services.msc and ensure “Windows Management Instrumentation” service Startup Type is set to Automatic.

In Firewall settings, click on the “Advanced settings” link. For the Inbound Rules, ensure “Windows Management Instrumentation (WMI-In)” is Enabled and Allowed for the Profile called Domain.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...