[WMI:MSBTSHostInstance]
disabled = 0
wql = SELECT * FROM MSBTS_HostInstance
namespace = root\MicrosoftBizTalkServer
index = temp_index
interval = 30
But I keep getting this error in splunkd.log file - Error occurred while trying to retrieve results from a WMI query (error="FormatMessage was unable to decode error (2148735236), (0x80131904)"
HRESULT=80131904) (root\MicrosoftBizTalkServer: SELECT * FROM MSBTS_HostInstance)
However if I run the same command from command line in SPLUNK_HOME\bin folder (command – splunk cmd splunk-wmi.exe –WQL “SELECT * FROM MSBTS_HostInstance” –namespace root\MicrosoftBizTalkServer) it gives
me the correct result. I tried restarting the WMI service adding debug modifying log.cfg and log-cmdline-debug files but no luck. Wbemtest also lists down all classes in the namespace. [I saw all these
troubleshooting steps in the link http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/TroubleshootingWMI] . Splunk UF is configured as local system account, I presume that should not be
an issue as it works in command line.
Can anyone please provide some pointers as to what is going on?
You mentioned that the forwarder is running as a local system account. Is the UF on the same device as the BizTalk server? If not, it seems likely that it's a permissions problem.
Can you (as a test) run the UF under the same account that you used to run the query from the CLI?
Perfectly said sbrant..it was the permission issue with local system account not being able to access the SQL server. I tried creating a batch file and running under splunk local system and it detailed the permission issue in splunkd.log. Thanks!!!
You mentioned that the forwarder is running as a local system account. Is the UF on the same device as the BizTalk server? If not, it seems likely that it's a permissions problem.
Can you (as a test) run the UF under the same account that you used to run the query from the CLI?