Getting Data In

WMI in windows 2000

katalinali
Path Finder

I have polled wmi query from windows 2000 to splunk, as there is not PerfFormattedData class. I use PerfRawData, but the cpu data in PerfRawData need some calculations so that it will give same result as PerfFormattedData. Can I modify splunk-wmi.exe or have any other method so the data input to splunk is right.

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

gkanapathy
Splunk Employee
Splunk Employee

No you can't. Of course Splunk provides a large number of commands to evaluate and transform data when you view it instead of when you index it.

0 Karma

katalinali
Path Finder

I know what is wql, my point is the calculation after polling value from wmi and before splunk access. I need the method which allow me to modify the data after generate from splunk-wmi.exe and before index by splunk. As the restricted environment, I can't use external program for the very last minute, so is splunk can provide a way to achieve my goal, for example, may I change some files so the splunk-wmi.exe can do calculation when it queries wql

Thanks

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...