Getting Data In

wmi.conf missing, WMI not working

cmcbride
New Member

I've added a server as a remote event log source to get splunk to collect events from that server. It appears to add it correctly, but no data is collected. There are no WMI errors in my splunkd.log file for collection errors. I seem to be missing a wmi.conf file from \etc\apps\windows\default\, and I'm getting these errors on a restart:

08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\admon.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\commands.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\distsearch.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\eventgen.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\macros.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\perfmon.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\regmon-filters.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\sysmon.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\wmi.conf: The system cannot find the file specified.
08-21-2013 12:33:41.527 -0500 WARN ConfPathMapper - Failed to open: F:\Program Files\Splunk\etc\apps\windows\default\workflow_actions.conf: The system cannot find the file specified.

I do have the Windows app installed, but we're not really using it.

Tags (3)
0 Karma
1 Solution

lukejadamec
Super Champion

It looks like you're "missing" a lot more than a wmi.conf file.

Is the Windows app disabled?

Check the Splunk\etc\apps\windows\default folder and check for the files listed above. If they are there then you have a permission problem. If they are not there then you should reinstall the Windows app.

View solution in original post

0 Karma

lukejadamec
Super Champion

It looks like you're "missing" a lot more than a wmi.conf file.

Is the Windows app disabled?

Check the Splunk\etc\apps\windows\default folder and check for the files listed above. If they are there then you have a permission problem. If they are not there then you should reinstall the Windows app.

0 Karma

cmcbride
New Member

Thanks for the answer. I ended up using Snare for what I needed actually.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...