Ensure the SplunkForwarder service Log On is a Domain Admin account.
Run services.msc and ensure “Windows Management Instrumentation” service Startup Type is set to Automatic.
In Firewall settings, click on the “Advanced settings” link. For the Inbound Rules, ensure “Windows Management Instrumentation (WMI-In)” is Enabled and Allowed for the Profile called Domain.
... View more