14.1 Windows Management Instrumentation (WMI) Inputs

Windows Management Instrumentation (WMI) Inputs

Quick Summary: WMI inputs let a Splunk instance running on Windows collect event logs and performance data from remote Windows machines without installing anything on them. The input runs as a separate process, splunk-wmi.exe, and is configured in wmi.conf with [WMI:<name>] stanzas that use either event_log_file or wql. It requires a domain user account with WMI rights, and Splunk itself recommends installing a universal forwarder on the target instead whenever possible.

Where a WMI Input Can Run

WMI (Windows Management Instrumentation) is Microsoft's management interface, and remote WMI uses DCOM/RPC. Splunk's WMI input therefore has to run on a Windows machine:

• Splunk Enterprise on Windows can collect WMI data directly.
• A universal forwarder or heavy forwarder on Windows can run the WMI input and forward the data. This is also the only way to get WMI data into Splunk Cloud Platform, because Splunk Cloud cannot connect to Windows machines using WMI.
• A Splunk instance on Linux or macOS cannot run WMI inputs.

The input runs as a separate process called splunk-wmi.exe, which Splunk's documentation describes as a scripted input. One WMI input can connect to multiple WMI providers (target machines).

How Collection Works (Pull Model)

1. The Windows Splunk instance reads its [WMI:<name>] stanzas from wmi.conf.
2. Every interval seconds, splunk-wmi.exe connects to each machine listed in server and runs the event log or WQL query.
3. The results come back over the network, become events, and are indexed locally or forwarded to the indexers.

All the collection load sits on the polling instance and the network, rather than being spread across the endpoints.

Configuring wmi.conf

wmi.conf lives on the Windows instance that collects the data, for example in %SPLUNK_HOME%\etc\system\local\ or in an app. You can also create WMI inputs in Splunk Web with the Remote event log monitoring and Remote Performance monitoring inputs. Configuration files expose more options. Restart Splunk after editing the file.

The [settings] Stanza (Optional, Global)

Input Stanzas: [WMI:<name>]

Each input stanza uses one of two types, and never both:

• Event log stanza: set event_log_file to a comma-separated list of channels such as Application, System.
• WQL stanza: set wql to a Windows Query Language statement. This is how you collect performance data.

If a stanza defines both settings, the input does not run.

Example 1: Remote Event Logs

[WMI:RemoteAppServerLogs]
server = app-srv01.corp.example, app-srv02.corp.example
event_log_file = Application, System
interval = 60
current_only = 1
index = winevent
disabled = 0

Example 2: Performance Data with a Standard WQL Query

[WMI:DomainControllerCPU]
server = dc01.corp.example
wql = SELECT Name, PercentProcessorTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name = '_Total'
interval = 15
index = perfmon
disabled = 0

Example 3: An Event Notification Query

[WMI:ProcessCreation]
server = app-srv01.corp.example
wql = SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'
current_only = 1
interval = 1
index = winevent

An event notification query has to be correctly structured. The spec says its WQL must contain a GROUP, WITHIN, or HAVING clause. Badly formed WQL stops the input from running.

Event Logs vs. WQL Data

• Event log stanzas keep a checkpoint. After a restart or outage, the input continues from the saved position, so events are not collected twice. With current_only = 1, events generated while Splunk was stopped are not collected when it starts again.
• WQL stanzas do not update the WMI checkpoint file. A WQL query returns dynamic data, so Splunk indexes the results as fresh data every time the stanza runs. A standard query on a static class (such as a list of services) produces the same events again at each interval.
• For performance data, prefer the formatted classes (Win32_PerfFormattedData_*), which return ready-to-use values such as percentages. The raw classes (Win32_PerfRawData_*) return counters that you would have to convert yourself.

Security and Network Prerequisites

Splunk's documentation lists these requirements for remote WMI:

• The Splunk instance must run as a domain user in the same Active Directory domain or forest as the targets, with permission to make remote connections and to query WMI. The user must also belong to the local Administrators group on the machine running Splunk.
• Local System does not work. It has no access to other machines on the network, and you cannot grant it such access.
• The Splunk user should not be a Domain Admin. Splunk recommends least-permissive access instead:
  • Local Security Policy user rights on each polled machine, such as Access this computer from the network and Log on as a service.
  • Membership in Distributed COM Users for DCOM access.
  • Membership in Performance Log Users for remote performance objects.
  • WMI namespace rights on Root and below: Execute Methods, Enable Account, Remote Enable, Read Security.
  • For event logs, a group with suitable access, such as Event Log Readers.
• Firewalls must allow WMI between the polling machine and the targets. Remote WMI uses the RPC endpoint mapper on TCP 135, followed by a dynamically assigned RPC port. Microsoft's default dynamic range on Windows Server 2008 and later is TCP 49152–65535.

To test access, Splunk documents running splunk cmd splunk-wmi -wql "select * from win32_service" -namespace \\<host>\root\cimv2 as the Splunk user. First, temporarily point the data store elsewhere with splunk set datastore-dir, so the test does not update the real WMI checkpoint.

WMI vs. a Universal Forwarder on the Target

Splunk's own guidance is: if possible, install a universal forwarder on the machine you want to collect Windows data from, rather than using WMI. The resource load of WMI can exceed that of a forwarder, especially when you collect several event logs or performance counters from each machine, or from busy machines such as domain controllers.