Splunk Enterprise

How do I remove the remote wmi data sources from splunk light?

bpeer
Engager

I set up splunk light and configured remote windows eventlog monitoring. Then I started reading about the Universal forwarders. Now I want to switch everything over to the UF but the ones I have set up are now listed twice as search hosts. How do I remove the wmi data collectors?

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

hi bpeer,
placing here to close the question
you can try to go to settings (top right) -> data inputs -> Remote Events Log Collection -> look for your WMI inputs. -> disable or delete
hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

hi bpeer,
placing here to close the question
you can try to go to settings (top right) -> data inputs -> Remote Events Log Collection -> look for your WMI inputs. -> disable or delete
hope it helps

0 Karma

bpeer
Engager

That is what I was looking for. Thank you adonio.

Brad

0 Karma

adonio
Ultra Champion

hi bpeer,
you can try to go to settings (top right) -> data inputs -> Remote Events Log Collection -> look for your WMI inputs. -> disable or delete
hope it helps

Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...