Getting Data In

WMI data index question

dbarbon
Engager

Hi I want to investigate about not responding application. 20 PC has this application installed but only 3 or 4 of them got blocking every night at 4:00 am.
No logs are generated, so I want to use WMI, but what counters I have to index?
Thanks in advance!

Tags (1)

dbarbon
Engager

Vladimir, thanks for your response.
Now I have to implement Splunk on the customer network and start searching!

Vladimir
Path Finder

I think it depends on what actually you want. I would start with standard windows application log and maybe processes info (wql = SELECT * FROM Win32_PerfFormattedData_PerfProc_Process WHERE Name LIKE "YourApplicationName%")

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...