Getting Data In

Get data from WMI to splunk forwarder

hectorvp
Communicator

I've a scenario where we have 300 windows  servers, due to few reason we are not able to install splunk forwarder.

The alternative thought is of  using WMI.

Since we've linux server as an splunk enterprise. We are anticipating to use an windows server as an intermediate forwarder (UF) which will collect logs from the target server WMI providers and an universal forwarder will forward it to Linux splunk enterprise.

Do I need to get the logs in splunk universal forwarder inputs.conf using powershell command Ex:

 

[powershell://CollectProcessInfoFromWmi] script = Get-CimInstance Win32_Process | Select-Object Field1, Field2, Field3 schedule = 0 */5 * ? * * sourcetype = Windows:MyWmiData

Or

 Will this path in inputs.conf will do same?

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0

What is the purpose of splunk-wmi.exe, will it be present with universal forwarder?

Apart from this,

just placing wmi.conf in its appropriate place will manage target servers and queries to thier logs?

Considering windows specific configurations are done (domain acc from AD,firewall & permissions) What are installation steps  for UF to work  with WMI?

Are their any complexities I'm missing if we use WMI approach?

And how reliable it could be to use WMI against 300servers generating more than 30GB of daily data to be indexed? As I came to know this uses some polling mechanism as against to UFs which push the data.

I've worked with UFs only in the past.

Network traffic or intermediate forwarder as a bottleneck,Could these be a risks?

 

 

 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...