I have noticed that Splunk Enterprise (6.5.3) will no longer pull events from a target machine via WMI if the machine (Win10 1607) has been asleep and subsequently awakes. In order to get events I have to restart splunkd.
Has anyone encountered this? I'd prefer not to install the forwarder, but I'm afraid that's my only option besides forcing the machines to stay awake. Thanks in advance,
Mark
↧