- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Usin Splunk forwarder
abe
New Member
01-28-2024
12:36 AM
Hi
I have installed a Splunk Forwarder on a remote computer and I chose wmi as data input in the main server. But when I want to find a log I get the message that remote computer is not reachable. This is while I have defined firewall rules for Splunk dynamic ports. Would you please help me?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
datadevops
Path Finder
01-28-2024
01:54 AM
Hi there,
The remote Splunk Forwarder might not be reachable due to:
- Connectivity: Ping the remote machine and check WMI service status.
- WMI configuration: Verify inputs.conf settings (server, namespace, credentials, source path).
- Firewall: Ensure firewall allows connections on Splunk dynamic ports (9997, 8089) and WMI port (135).
- Authentication: Double-check Splunk credentials have WMI access on the remote machine.
- Logs: Review Splunk logs on both machines for errors or warnings.
If these don't help, consider:
- Testing WMI connection manually using wbemtest.exe.
- Enabling debug logging in inputs.conf for more detailed logs.
- Using file inputs instead of WMI if necessary.
Please provide more details (Splunk version, error messages) if you need further assistance.
~ If the reply helps, a Karma upvote would be appreciated
