Dear all,
I just upgraded splunk to 6.5. After finished, I find cannot get WMI event from other server. The splunk server and other server are in same domain. I checked the log and it show following message.
10-25-2016 11:01:34.544 +0800 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-wmi.exe"" WMI - Unable to connect to WMI namespace "\HQ1\root\cimv2" (attempt to connect took 29.00 milliseconds) (error="Access is denied." HRESULT=80070005)
Before upgrade, we created another credential for splunk to remote other server to get WMI event and it is work. However, it fail after upgrade to 6.5. May I know how to put those credential on splunk?
Maybe your input is impacting by this issue :
http://docs.splunk.com/Documentation/Splunk/6.5.0/ReleaseNotes/KnownIssues
SPL-34347 = wmi input default fields - with value including newlines doesn't search properly becasue of \r\n issue
Hi,
verify that the splunk run user have the permission to read wmi data. If the splunk run user is not a domain admin you must verify that it has the permission to gather wmi information.
for additional information read the docs.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/MonitorWindowseventlogdata
kind regards