Getting Data In

Get data from WMI to splunk forwarder


I've a scenario where we have 300 windows  servers, due to few reason we are not able to install splunk forwarder.

The alternative thought is of  using WMI.

Since we've linux server as an splunk enterprise. We are anticipating to use an windows server as an intermediate forwarder (UF) which will collect logs from the target server WMI providers and an universal forwarder will forward it to Linux splunk enterprise.

Do I need to get the logs in splunk universal forwarder inputs.conf using powershell command Ex:


[powershell://CollectProcessInfoFromWmi] script = Get-CimInstance Win32_Process | Select-Object Field1, Field2, Field3 schedule = 0 */5 * ? * * sourcetype = Windows:MyWmiData


 Will this path in inputs.conf will do same?

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0

What is the purpose of splunk-wmi.exe, will it be present with universal forwarder?

Apart from this,

just placing wmi.conf in its appropriate place will manage target servers and queries to thier logs?

Considering windows specific configurations are done (domain acc from AD,firewall & permissions) What are installation steps  for UF to work  with WMI?

Are their any complexities I'm missing if we use WMI approach?

And how reliable it could be to use WMI against 300servers generating more than 30GB of daily data to be indexed? As I came to know this uses some polling mechanism as against to UFs which push the data.

I've worked with UFs only in the past.

Network traffic or intermediate forwarder as a bottleneck,Could these be a risks?




0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>