Getting Data In

Is it possible to use WMI on a Windows universal forwarder and send it to indexers and search heads running Linux?

smvalois
Explorer

I currently am running splunk enterprise on a Linux Distribution (Red Hat). I am following the guide to import WMI data to splunk, and there is no "Remote event log collections".

Deployment: Linux
Forwarder: Windows 7 (64 bit)

Is it possible to use WMI on a Windows forwarder and send it to indexer / search heads running linux?

1 Solution

ekost
Splunk Employee
Splunk Employee

I'm guessing you attempted to configure Remote event log collections from a linux box.

Here's what I did: Start up an ancient Windows VM, dropped in a copy of Splunk 6.1.4 and ran an install.
Once installed, I went to Settings > Data Inputs and chose Remote event log collections.
I configured a remote connection in the UI, which updates a couple .conf files and restarted the services.
I verified data was coming into the instance.

Now I have a choice:

  1. I can turn my full Splunk instance into a Light or Heavy forwarder, point it at the indexer, and let that instance poll other nodes over WMI and forward the data.
  2. I can collect all the .conf file pieces, and place them into a pre-configred Windows Universal forwarder installation.

You can read about the different forwarders here.
You can review common troubleshooting tips for WMI connections here.

View solution in original post

ekost
Splunk Employee
Splunk Employee

I'm guessing you attempted to configure Remote event log collections from a linux box.

Here's what I did: Start up an ancient Windows VM, dropped in a copy of Splunk 6.1.4 and ran an install.
Once installed, I went to Settings > Data Inputs and chose Remote event log collections.
I configured a remote connection in the UI, which updates a couple .conf files and restarted the services.
I verified data was coming into the instance.

Now I have a choice:

  1. I can turn my full Splunk instance into a Light or Heavy forwarder, point it at the indexer, and let that instance poll other nodes over WMI and forward the data.
  2. I can collect all the .conf file pieces, and place them into a pre-configred Windows Universal forwarder installation.

You can read about the different forwarders here.
You can review common troubleshooting tips for WMI connections here.

smvalois
Explorer

Thank you, this is similar to the method I used as well. I basically made the WMI.conf file on my windows forwarder (dropping a full version would have probably been much easier).

0 Karma

ekost
Splunk Employee
Splunk Employee

Yes, you can use a forwarder to collect data via WMI and send the results to a linux-based Splunk instance. Check the table here for what is required to monitor hosts using WMI. That topic includes a wmi.conf example. The reasons for collecting data via WMI instead of using forwarders must be evaluated and the trade-offs reviewed.

smvalois
Explorer

We operate in an environment where agents are viewed as evil. I do not personally agree with that, but will take the wins where I can get them. According to that table, splunk enterprise must be running on windows. My linux enterprise version does not list "Remote Event Log Collections" as an option under data inputs. Is there an addon I have to install?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi,

snip of @ekost's answer: Yes, you can use a forwarder to collect data via WMI and send the results to a linux-based Splunk instance.

0 Karma

smvalois
Explorer

Sorry, I know I sound like a broken record here. The issue is following the instructions to get this setup. The link is here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/MonitorWindowsdata

Under "Configure remote event log monitoring", it says go to Data Inputs and click Remote Event Log Collections. That option is not there. All I have is TCP, UDP, Local File and Scripts. Is there something else I need to install for that to show up?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...