windows logs

[kovacez]

Hello everybody,
I am really newbie @splunk. please bare with me

I downloaded windows app. I am trying to configure splunk to monitor windows server. So i am going through the wizard, clicked on Get remote event logs via WMI > specified the host and clicked on tab "find logs" and the search returns :
Failed to fetch data: In handler 'win-wmi-enum-eventlogs': Unable to get wmi classes from host '10.1.6.19'. This host may not be reachable or WMI may be misconfigured.

Any ideas why? If i should configure the rights to the windows servers, where that would be? I checked the forums and documentation and could not find the answer
thx

[kovacez]

here is the fix
http://splunk-base.splunk.com/answers/3701/how-to-get-wmi-data-collection-by-providing-to-splunk-the...

[jacksamson]

Ensure the SplunkForwarder service Log On is a Domain Admin account.

Run services.msc and ensure “Windows Management Instrumentation” service Startup Type is set to Automatic.

In Firewall settings, click on the “Advanced settings” link. For the Inbound Rules, ensure “Windows Management Instrumentation (WMI-In)” is Enabled and Allowed for the Profile called Domain.