Getting Data In

How to configure the universal forwarder to collect System Properties on a Windows Server?

jrhoads
New Member

How can I configure the universal forwarder to collect the hosts system properties?

0 Karma

maciep
Champion

You should be able to use wmi.conf to query whatever WMI classes you'd like (win32_computersystem, win32_operatingsystem, etc).

0 Karma

jrhoads
New Member

If I search the link provided and search for the win32_* items mentioned there is no reference found. Are there example configurations for System Assigned Ram, etc?

0 Karma

maciep
Champion

if you look in the example conf file at the bottom of that page, specifically at the wql settings, you should see how to query wmi. For example:

[WMI:LocalPhysicalDisk]
interval = 1
wql = select Name, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk
disabled = 0
index = wmi_perfmon

If you need to know where in WMI to find the data you want, that's probably going to be all google. For example, the win32_computersystem class has a field for TotalPhysicalMemory. And the win32_physicalmemory class has a field called capacity.

I guess another option is to see if the add-on for windows would work for you too. Maybe that would be easier?

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...