WMI Splunk pull remote logs

JPaule · ‎07-12-2018

What further configuration is needed to pull WMI logs from remote servers, currently we are only getting back data from the local host?

Followed this documentation and ensured permissions were correct, to no avail:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorWMIdata

adonio · ‎07-12-2018

why WMI and not Universal Forwarder?

JPaule · ‎07-13-2018

Do you mean use UF to get WMI data? I need WMI because it's the only way to get a certain type of data. I'm trying to pull in data for windows service accounts that are running services across all 200 of my servers.

adonio · ‎07-14-2018

what kind of data are you looking to get out of your 200 windows machines?
i am almost 100% positive you can leverage the UF to bring that data, easier and cleaner than WMI

WMI Splunk pull remote logs

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

WMI Splunk pull remote logs

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future