Getting Data In

Getting Error When trying to read windows event logs from am remote machine.

harshavrath
Contributor

HI
I'm getting an error as "Failed to fetch data: In handler 'win-wmi-enum-eventlogs': Unable to get wmi classes from host '...*'. This host may not be reachable or WMI may be misconfigured."

I'm i getting this error because my Splunk is installed as Local User.?

Splunk is installed on Windows Server 2003.

Splunk is installed in an US Machine by my manager I'm remotely logging in & using it.

Tags (3)
0 Karma
1 Solution

wcolgate_splunk
Splunk Employee
Splunk Employee

In order to collect WMI data from the remote machine, the user connecting must have rights on the remote machine. I'm confident that you will need to install splunk as a specific user and then give that user WMI rights on the collection target. In addition, 6.0.x and prior, your specific user will also have to be a member of the local admin group on the machine splunk is installed on.

View solution in original post

wcolgate_splunk
Splunk Employee
Splunk Employee

In order to collect WMI data from the remote machine, the user connecting must have rights on the remote machine. I'm confident that you will need to install splunk as a specific user and then give that user WMI rights on the collection target. In addition, 6.0.x and prior, your specific user will also have to be a member of the local admin group on the machine splunk is installed on.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...