Getting Data In

Get data from WMI to splunk forwarder

hectorvp
Communicator

I've a scenario where we have 300 windows  servers, due to few reason we are not able to install splunk forwarder.

The alternative thought is of  using WMI.

Since we've linux server as an splunk enterprise. We are anticipating to use an windows server as an intermediate forwarder (UF) which will collect logs from the target server WMI providers and an universal forwarder will forward it to Linux splunk enterprise.

Do I need to get the logs in splunk universal forwarder inputs.conf using powershell command Ex:

 

[powershell://CollectProcessInfoFromWmi] script = Get-CimInstance Win32_Process | Select-Object Field1, Field2, Field3 schedule = 0 */5 * ? * * sourcetype = Windows:MyWmiData

Or

 Will this path in inputs.conf will do same?

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0

What is the purpose of splunk-wmi.exe, will it be present with universal forwarder?

Apart from this,

just placing wmi.conf in its appropriate place will manage target servers and queries to thier logs?

Considering windows specific configurations are done (domain acc from AD,firewall & permissions) What are installation steps  for UF to work  with WMI?

Are their any complexities I'm missing if we use WMI approach?

And how reliable it could be to use WMI against 300servers generating more than 30GB of daily data to be indexed? As I came to know this uses some polling mechanism as against to UFs which push the data.

I've worked with UFs only in the past.

Network traffic or intermediate forwarder as a bottleneck,Could these be a risks?

 

 

 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!