Getting Data In

WMI queries using the LightWeightFowarder hammering each server every second with 5 to 10 per second

billconnell
Engager

I am being told that was the default. I am seeing over 2 Billion WMI records, most (1.6 B) are from WMI:LocalProcesses, they look like a record for every process running on every windows server every second. Seems like a rediculus load on each server plus the overworked Splunk Linux server. (no polling WMI is setup on then Indexer)

WMI:LocalProcesses | 1,642,530,389 WMI:LocalNetwork | 171,412,864 WMI:FreeDiskSpace | 164,186,039 WMI:LocalPhysicalDisk | 44,962,006 WMI:Memory | 43,502,032 WMI:CPUTime | 43,461,901

I would like to change the WMI queries to once every 10 minutes, not ever second. And not effic the eventlogging.

Which "interval" line is the correct one to fix this?

Thanks, Bill

Tags (1)
0 Karma

southeringtonp
Motivator

Each WMI query will have it's own configuration, and you can adjust the interval independently.


Configure via the Manager:

In the Manager, choose Data Inputs, then WMI Collections. Each WMI input will have its own entry there, with the polling intervals shown.

Click on the name, e.g. LocalProcesses, wait for the page to display, and change the option Poll Every at the bottom of the screen to your desired interval. Click Save.


or, Configure via the Config Files:

First, look at the default configuration in $SPLUNK_HOME\etc\apps\windows\default\wmi.conf to see the default configuration. Make particular note of the stanza names and the interval setting.

Then, create a new file or edit the existing $SPLUNK_HOME\etc\apps\windows\local\wmi.conf (local vs. default).

In that file, create a new stanza matching each of the settings you want to override, e.g.:

[WMI:LocalProcesses]
interval = 600
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...