Getting Data In

WMI - How many remote Windows can a Splunk WMI input support?

melonman
Motivator

Hi

I am planning to monitor many Windows client via WMI interface.
I have one Splunk installed on Windows7.
How many remote Windows can a Splunk WMI input support?
Do we have any estimation calculation about the number of max number of target windows hosts?
10s, 100s, or 1000s windows hosts?

Thanks!

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee

It depends on how busy the remote hosts are. As a rule of thumb, one Splunk instance (forwarder or indexer) can support the collection of Security Event Logs (the most verbose variety) on between 20 and 50 remote hosts. To scale out collection on more remote hosts, simply add another Splunk instance (forwarder or indexer) to collect another from another 20 to 50 remote hosts. Rinse and repeat.

All that said, I would strongly recomment installing the Splunk Forwarder, a relatively lightweight build of Splunk that has no UI and no indexing, on your hosts rather than using WMI. Beyond better resiliance by collecting Event Logs and other WMI data remotely, you will be able to easily collect and forward other data such as DNS, DHCP, Windows Update, and application logs.

View solution in original post

araitz
Splunk Employee
Splunk Employee

It depends on how busy the remote hosts are. As a rule of thumb, one Splunk instance (forwarder or indexer) can support the collection of Security Event Logs (the most verbose variety) on between 20 and 50 remote hosts. To scale out collection on more remote hosts, simply add another Splunk instance (forwarder or indexer) to collect another from another 20 to 50 remote hosts. Rinse and repeat.

All that said, I would strongly recomment installing the Splunk Forwarder, a relatively lightweight build of Splunk that has no UI and no indexing, on your hosts rather than using WMI. Beyond better resiliance by collecting Event Logs and other WMI data remotely, you will be able to easily collect and forward other data such as DNS, DHCP, Windows Update, and application logs.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...