Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- wmi.conf missing, WMI not working
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've added a server as a remote event log source to get splunk to collect events from that server. It appears to add it correctly, but no data is collected. There are no WMI errors in my splunkd.log file for collection errors. I seem to be missing a wmi.conf file from
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\admon.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\commands.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\distsearch.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\eventgen.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\macros.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\perfmon.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\regmon-filters.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\sysmon.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\wmi.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\workflow_actions.conf: The system cannot find the file specified.
I do have the Windows app installed, but we're not really using it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like you're "missing" a lot more than a wmi.conf file.
Is the Windows app disabled?
Check the Splunk\etc\apps\windows\default folder and check for the files listed above. If they are there then you have a permission problem. If they are not there then you should reinstall the Windows app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like you're "missing" a lot more than a wmi.conf file.
Is the Windows app disabled?
Check the Splunk\etc\apps\windows\default folder and check for the files listed above. If they are there then you have a permission problem. If they are not there then you should reinstall the Windows app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the answer. I ended up using Snare for what I needed actually.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Skip the Awkward Silence: Have a .conf-ersation at .conf26
Rethinking Zero Trust: From Product Purchases to Logical Control Evidence
