WMI queries using the LightWeightFowarder hammering each server every second with 5 to 10 per second

Question

I am being told that was the default. I am seeing over 2 Billion WMI records, most (1.6 B) are from WMI:LocalProcesses, they look like a record for every process running on every windows server every second. Seems like a rediculus load on each server plus the overworked Splunk Linux server. (no polling WMI is setup on then Indexer)

I would like to change the WMI queries to once every 10 minutes, not ever second. And not effic the eventlogging.

Which "interval" line is the correct one to fix this?

Thanks, Bill

Answer 1

Each WMI query will have it's own configuration, and you can adjust the interval independently.

Configure via the Manager:

In the Manager, choose Data Inputs, then WMI Collections. Each WMI input will have its own entry there, with the polling intervals shown.

Click on the name, e.g. LocalProcesses, wait for the page to display, and change the option Poll Every at the bottom of the screen to your desired interval. Click Save.

or, Configure via the Config Files:

First, look at the default configuration in $SPLUNK_HOME\etc\apps\windows\default\wmi.conf to see the default configuration. Make particular note of the stanza names and the interval setting.

Then, create a new file or edit the existing $SPLUNK_HOME\etc\apps\windows\local\wmi.conf (local vs. default).

In that file, create a new stanza matching each of the settings you want to override, e.g.:

[WMI:LocalProcesses]
interval = 600

WMI queries using the LightWeightFowarder hammering each server every second with 5 to 10 per second

Follow this question

Splunk Resources

Related questions