Dashboards and Queries for Splunk Add-on for Oracle Database

[aliakbar22]

I have installed & configured Splunk Add-on for Oracle Database on Splunk server instance. As per my understanding, this add-on will only facilitate the forwarding of corresponding Oracle system db logs and other information that can be used for database monitoring and performance analysis. However, there are no pre-defined dashboards or search queries to leverage on this data. Can someone please suggest some Splunk search queries or suggest an app to create dashboards displaying info like database status (up or down), queries taking maximum time, problems in db etc?

[jcoates_splunk]

Also, the add-on does comes with some pre-built panels that you can use in Splunk 6.2 or better... just make a new Dashboard, Add Panel, and look for Oracle down in the prebuilt panels section.

[pmdba]

The Splunk Add-on for Oracle is a collection of sample SQL data inputs. There really isn't a lot there to build comprehensive dashboards from, in my opinion. Most of the data being collected in the examples either doesn't change at all (or very rarely), keeps cumulative statistics from the time of database startup (making comparison of different time ranges tricky), or - in my opinion - provides relatively meaningless data that is only valid in the split second in which it was collected.

Using Splunk to collect the kind of performance information you are describing isn't really possible at this time; there are much more specialized tools out there for that purpose. Not saying it couldn't be done with Splunk, but it hasn't been done yet. Splunk's main value at the current time - again, in my opinion - is in collecting log and audit data from Oracle that will allow you to identify and diagnose infrastructure level issues or external (non-SQL related) problems. For a look at how to create your own Oracle monitoring app, including sample inputs in a variety of styles and some dashboard ideas, try taking a look at this: Log File Analysis for Oracle 11g