Getting Data In

Why not all Windows Classes show up in WMI "available classes"?

elusive
Splunk Employee
Splunk Employee

I go to "Manager » Data inputs » WMI data collections » Add New" and enter the host name under "Select target host". I don't see all the classes that I want to select. Why?

Tags (2)

elusive
Splunk Employee
Splunk Employee

The above information is true for older Splunk version, however, with 4.2.x and 4.3.x Win32_PerfFormattedData_* are filtered and will not show up in wmi Splunk Web. If you wish to monitor, it needs to be added manually directly in wmi.conf and restart Splunk.

0 Karma

elusive
Splunk Employee
Splunk Employee

Any classes with a Win32_PerfFormattedData_* prefix will show up in the list. Other classes that does not have Win32_PerfFormattedData_* prefix will not show up in the available classes list.

If you wish to index other than prefixed Win32_PerfFormattedData_* you can enter it manually directly into wmi.conf.

When collecting WMI events make sure that you are able to query in wbemtest using wql as the account who is starting up Splunk services

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...