Getting Data In

Getting Error When trying to read windows event logs from am remote machine.

harshavrath
Contributor

HI
I'm getting an error as "Failed to fetch data: In handler 'win-wmi-enum-eventlogs': Unable to get wmi classes from host '...*'. This host may not be reachable or WMI may be misconfigured."

I'm i getting this error because my Splunk is installed as Local User.?

Splunk is installed on Windows Server 2003.

Splunk is installed in an US Machine by my manager I'm remotely logging in & using it.

Tags (3)
0 Karma
1 Solution

wcolgate_splunk
Splunk Employee
Splunk Employee

In order to collect WMI data from the remote machine, the user connecting must have rights on the remote machine. I'm confident that you will need to install splunk as a specific user and then give that user WMI rights on the collection target. In addition, 6.0.x and prior, your specific user will also have to be a member of the local admin group on the machine splunk is installed on.

View solution in original post

wcolgate_splunk
Splunk Employee
Splunk Employee

In order to collect WMI data from the remote machine, the user connecting must have rights on the remote machine. I'm confident that you will need to install splunk as a specific user and then give that user WMI rights on the collection target. In addition, 6.0.x and prior, your specific user will also have to be a member of the local admin group on the machine splunk is installed on.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...