Universal fowarder and WMI

Question

I want to configure the universal fowarder to poll WMI data and forward it to my indexer. I understand that I need a wmi.config file for the universal fowarder, however I do not know what to put it in it.

I want to be able to poll the following that is the same as the windows app.

WMI: Memory WMI: LocalPhysicalDisk WMI: CPU Time WMI: LocalNetwork

Thanks in advance!

Accepted Answer

2

[WMI:LocalPhysicalDisk]
interval = 3600
wql = select Name, CurrentDiskQueueLength, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk
index = default
disabled = 0

[WMI:LocalProcesses]
interval = 3600
wql = select Name, IDProcess, PrivateBytes, PercentProcessorTime from Win32_PerfFormattedData_PerfProc_Process
index = default
disabled = 0

[WMI:Memory]
interval = 3600
wql = select PagesPerSec, AvailableMBytes, CommittedBytes, PercentCommittedBytesInUse from Win32_PerfFormattedData_PerfOS_Memory
index = default
disabled = 0

[WMI:LocalNetwork]
interval = 3600
wql = select Name, BytesReceivedPerSec, BytesSentPerSec, BytesTotalPerSec, CurrentBandwidth from Win32_PerfFormattedData_Tcpip_NetworkInterface
index = default
disabled = 0

[WMI:CPUTime]
interval = 3600
wql = SELECT PercentProcessorTime,PercentUserTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name="_Total"
index = default
disabled = 0

link

answered 06 Feb, 04:42

imrago
685●2●9
accept rate: 35%

you are the awesome thanks so much!

(06 Feb, 04:45) tympaniplayer

is there anything I need to do to enable this to forward the data?

(06 Feb, 04:59) tympaniplayer

try to change the interval from 3600 to something smaller, to get the sample more frequently

Is the connection in place between UF and the indexer?

there is a useful app: en-US/app/SplunkDeploymentMonitor/all_forwarders

(06 Feb, 05:27) imrago

yeah I put the interval down considerably and yes the connection is in place, it is receiving perfmon data. Thanks for all your help

(06 Feb, 05:45) tympaniplayer

I seem to not be receiving the WMI data though.

(06 Feb, 05:54) tympaniplayer

you could add the following two lines to inputs.conf, change someindexname to something else and restart the UF

[default] index = someindexname

(06 Feb, 05:54) imrago

All i needed to do was restart. Thanks!

(06 Feb, 12:40) tympaniplayer

showing 5 of 7 show 2 more comments ▼

Answer 2

0	Really stupid question, sorry but where does wmi.conf have to be put? link answered 09 Feb, 17:05 chrismor 11●2 accept rate: 0% ect/system/local (10 Feb, 03:51) tympaniplayer or in an app if you deploy your configuration in apps. $SPLUNK_HOME/etc/apps/<myapp>/local/ (10 Apr, 19:44) yannK

Universal fowarder and WMI

Follow this question

Splunk Resources

Related questions