Getting Data In

Splunk WMI on Universal Forwarder

anshu2812
Explorer
  1. I am writing a WQL on my universal forwarder to read data from my BizTalk server. I have configured my wmi.conf as below –

[WMI:MSBTSHostInstance]
disabled = 0
wql = SELECT * FROM MSBTS_HostInstance
namespace = root\MicrosoftBizTalkServer
index = temp_index
interval = 30
But I keep getting this error in splunkd.log file - Error occurred while trying to retrieve results from a WMI query (error="FormatMessage was unable to decode error (2148735236), (0x80131904)"

HRESULT=80131904) (root\MicrosoftBizTalkServer: SELECT * FROM MSBTS_HostInstance)

            However if I run the same command from command line in SPLUNK_HOME\bin folder (command – splunk cmd splunk-wmi.exe –WQL “SELECT * FROM MSBTS_HostInstance” –namespace root\MicrosoftBizTalkServer) it gives 
           me the correct result. I tried restarting the WMI service adding debug modifying log.cfg and log-cmdline-debug files but no luck. Wbemtest also lists down all classes in the namespace. [I saw all these 
           troubleshooting steps in the link http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/TroubleshootingWMI] . Splunk UF is configured as local system account, I presume that should not be 
           an issue as it works in command line. 

Can anyone please provide some pointers as to what is going on?

Tags (1)
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

You mentioned that the forwarder is running as a local system account. Is the UF on the same device as the BizTalk server? If not, it seems likely that it's a permissions problem.

Can you (as a test) run the UF under the same account that you used to run the query from the CLI?

View solution in original post

anshu2812
Explorer

Perfectly said sbrant..it was the permission issue with local system account not being able to access the SQL server. I tried creating a batch file and running under splunk local system and it detailed the permission issue in splunkd.log. Thanks!!!

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

You mentioned that the forwarder is running as a local system account. Is the UF on the same device as the BizTalk server? If not, it seems likely that it's a permissions problem.

Can you (as a test) run the UF under the same account that you used to run the query from the CLI?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...