Splunk Enterprise Security

Collect remote event logs through WMI

16gym
New Member

My splunk server and remote host server is in the same network.
In the Splunk server, I went Settings-->Data inputs-->Remote Event Log Collection-->New event log collection, and typed the following:
Event Log collection name: Test
Choose logs from this host: 10.22.85.177

An error message "Unable to get wmi classes from host '10.22.85.177'. This host may not be reachable or WMI may be misconfigured." is shown.
I configured them according to this post: https://splk.it/2SIjPft
but it didn't work.

I would like to know how should I configure the WMI settings on the remote host?
Thanks!

0 Karma

deepashri_123
Motivator

Hey@16gym,

You can try referring this link:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/MonitorWMIdata

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...