Security

WMI Splunk pull remote logs

JPaule
Explorer

What further configuration is needed to pull WMI logs from remote servers, currently we are only getting back data from the local host?

Followed this documentation and ensured permissions were correct, to no avail:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorWMIdata

Tags (1)
0 Karma

adonio
Ultra Champion

why WMI and not Universal Forwarder?

0 Karma

JPaule
Explorer

Do you mean use UF to get WMI data? I need WMI because it's the only way to get a certain type of data. I'm trying to pull in data for windows service accounts that are running services across all 200 of my servers.

0 Karma

adonio
Ultra Champion

what kind of data are you looking to get out of your 200 windows machines?
i am almost 100% positive you can leverage the UF to bring that data, easier and cleaner than WMI

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...