×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
kowallik_n
New Member
Member since: ‎12-21-2010
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎12-21-2010
Activity Feed
View All

Re: Remote Eventlog Collection stopped working

by in Getting Data In
‎12-22-2010 09:50 AM
‎12-22-2010 09:50 AM
ok... so far i have no luck. Filesystem Permissions are ok Domain Permissions are ok Virusscanner disabled on plunk server & target machine -> no results index=_internal source="*splunkd.log" wmi -> only 2 info entries since yesterday 12/21/10 4:12:01.588 PM 12-21-2010 16:12:01.588 INFO IndexProcessor - rtsearch connection terminated, filter = '[ AND index::main wmi ]', _actionStreams = 0 12/21/10 4:10:40.885 PM 12-21-2010 16:10:40.885 INFO IndexProcessor - rtsearch connection established, filter = '[ AND index::main wmi ]', _activeStreams = 1, queue_size = 10000, blocking = FALSE It's like there isn't even an attempt to read the eventlogs from the remote machine. ... View more

Remote Eventlog Collection stopped working

by in Getting Data In
‎12-21-2010 11:36 AM
‎12-21-2010 11:36 AM
Hello everone, on the weekend i messed up the Splunk Installation whith the try to move the Database to a different place. But because i'm just starting using splunk a quick reinstall got it back working... well all except Remote eventlog Collection (via WMI) I created a new Data Input selected only the Application log on teh remote server, but nothing happens. I checked with Splunk\bin>splunk-wmi -wql "select * from win32_service" -namespace \server\root\cimv2 if teh WMI Permissions are right and data came in just fine. Then i tried it with renaming the wmi_checkpoint file (to force a reindex), but even after a restart nothing happens. Any suggestion how to fix this is appreciated. With regards, Norbert ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:02 AM