We are getting a lot of errors from the splunkd.log about a failing splunk-wmi.exe. Here is the exact error: ERROR ExecProcessor - message from ""D:\Program Files\Splunk\bin\splunk-wmi.exe"" WMI - Unable to connect to WMI namespace "root\cimv2" (attempt to connect took 0 microseconds) (error="One of the parameters to the call is not correct." HRESULT=80041008) This seems to be happening on mostly the 2k servers but not all of them, and the 2k8 servers are fine. Also the failing servers, when I run the following command I get the same result: splunk-wmi.exe -wql "select PagesPerSec, AvailableMBytes, CommittedBytes, PercentCommittedBytesInUse from Win32_PerfFormattedData_PerfOS_Memory" Also when I ran that query using "wbemtest" on one of the failing servers, I get an invalid class error (80041010). Why would this error be different from splunk? We also tried restarting winmgmt and deleting the repository but that didn't change anything. Does the missing class just mean that server does not have the required wmi object and that wql cannot be run there. If so what would be a different wql we could run to get the cputime and memory? Also is there a way to blacklist the windows app in the serverclass.conf by specifying the os type? Thanks ... View more

Hi, it seems like this should be something simple, but I was unable to find this anywhere in the documentation or past questions. I want the Splunk to index the initial file that I am going to monitor even if the file was not modified. It seems like when I monitor some file, it only gets indexed if a change occurs which is fine. But if I just started monitoring some file, I need to seem some indexed data that I will be able to query. Here is my current configuration in the input.conf file. Also, this is on a forwarder if that makes any difference. [monitor://C:\Testing\] whitelist = config alwaysOpenFile = 1 disabled = 0 interval = 60 followTail = 0 index = configindex _TCP_ROUTING = rcvr_9903 Thanks. ... View more

Hi, I would like to monitor all the web.config files on my machine and then forward the results to a Splunk receiver. I have tried creating a file monitoring data input of: [monitor://.../web.config] disabled = false sourcetype = webconfig [monitor://...] disabled = false sourcetype = webconfig whitelist = web.config But nothing seems to work. Its probably unlikely that something like this would work because of the overhead of searching in all directories, but I was hoping Splunk would be able to. Maybe search all directories once a day and memorize the location of the other web.config files. Thanks. ... View more

Past two day I have been working on modifying a Splunk forwarder configuration to monitor a certain registries. After playing around with the sysmon.conf,regmon-filters.conf, and inputs.conf files, I have finally created something that works to a certain degree. When I make changes to a Registry key value located in the hive targeted by the regmon-filters.conf file, Splunk forwards that change to the reciever server. My problem is that I want Splunk to index the registries in the specified hive without the registries having to be modified. I need Splunk to index a certain registry each interval even if the registy value has not changed. Currently my regmon-filters.conf looks something like this: [Test Registries Monitor] proc = .* hive = \\REGISTRY\\USER\\\.DEFAULT\\Console\\.* type = set|create|delete|rename|query baseline = 0 I believe I have use all the available 'type's and all of them require some kind of modification of the registry. I haven't seen anything in the documentation but can I remove type and just have this registry monitored every interval no matter what? Also when I set the baseline to true, Splunk indexes all registries in the \REGISTRY\USER\.* hive and not the targeted location. But when I modify a registry, it only indexes keys that are in the entire target location. Why is that? I really hope someone could help me out with this. This entire process has been really frustrating. Thanks. ... View more

Hi, I know I am able to monitor the registry on the local machine where Splunk is run. How about if I want Splunk to monitor the registry of several servers on our network. I thought I would be able to do this with WMI collections but I could not figure out how to specify which specific registry values I want to monitor. If I setup Splunk on the servers which I want to monitor and let them monitor their local registries, will I be able to forward that information to the main Splunk indexer? I am still just learning all of Splunk functionalities, so please provide specifics or let me know if I said stated something completely wrong. Thanks. ... View more

Hi, I am having trouble in create a condition for an alert that I would like. I have just started using Splunk and I do not know all the fancy search conditions. So I have indexed results for all our projects that contain information like the number of unit tests failed. Sample events being : | Project: A | FailedTests: 0| Date: 12062010 | ... | Project: B | FailedTests: 3| Date: 11042010 | ... I would like an alert whenever the number of tests failed for a certain project is greater then that of the last value for the number of tests failed. Is there any custom condition that I could use to do this? Thanks in advance. ... View more

Hi, I just started working with splunk so if I am too vague or confusing let me know. I want to know if it is possible to create a saved report and view it based on the specified value of some field? For example I have: Project Name: A | Failed Tests: 4 Project Name: B | Failed Tests: 1 Project Name: A | Failed Tests: 3 ... and so on I want a report that will show the trends of the number of tests failed each day for a certain project. I want to be able to save that report. Then when somebody wants to view the trend of failing test for some project, all they have to do is click on that saved report and specify the project that they are interested in. ... View more