Security

WMI Splunk pull remote logs

JPaule
Explorer

What further configuration is needed to pull WMI logs from remote servers, currently we are only getting back data from the local host?

Followed this documentation and ensured permissions were correct, to no avail:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorWMIdata

Tags (1)
0 Karma

adonio
Ultra Champion

why WMI and not Universal Forwarder?

0 Karma

JPaule
Explorer

Do you mean use UF to get WMI data? I need WMI because it's the only way to get a certain type of data. I'm trying to pull in data for windows service accounts that are running services across all 200 of my servers.

0 Karma

adonio
Ultra Champion

what kind of data are you looking to get out of your 200 windows machines?
i am almost 100% positive you can leverage the UF to bring that data, easier and cleaner than WMI

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...