Seems to be a problem with backslashes: PS C:\Program Files\SplunkUniversalForwarder\bin> .\splunk cmd splunk-wmi -wql 'SELECT PercentProcessorTime,PercentUserT ime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name=\"_Total\"' -namespace \\localhost\root\cimv2 ***SPLUNK*** index= source="WMI:unspecified" sourcetype="WMI:unspecified" ---splunk-wmi-end-of-event--- 20150211091552.843920 PercentProcessorTime=38 PercentUserTime=17 wmi_type=unspecified ---splunk-wmi-end-of-event--- Clean shutdown completed. PS C:\Program Files\SplunkUniversalForwarder\bin> .\splunk cmd splunk-wmi -wql 'SELECT PercentProcessorTime,PercentUserT ime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name="_Total"' -namespace \\localhost\root\cimv2 ERROR WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (.: SELECT PercentProcessorTime,PercentUserTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE N ame=_Total) ERROR WMI - Giving up attempt to connect to WMI provider after maximum number of retries at maximum backoff time (.: SEL ECT PercentProcessorTime,PercentUserTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name=_Total) Clean shutdown completed. ... View more

Yes that's possible. You have to do two things: Comment the line assertInvokerIsSuperuser in the rlog.sh, so no super-user check is done. Give the user that is running splunk read-access to the audit.log, e.g. /var/log/audit/audit.log in RedHat. ... View more

I had the same problem, did the same things as you did. Then I updated the Splunk Universal Forwarder to 6.2.1 (build 245427) and the problem went away. Seems to be a bug. ... View more