All Apps and Add-ons

Does Splunk integrate with or supports Windows SCOM?

maverick
Splunk Employee
Splunk Employee

Wondering if Splunk integrates with or supports Windows SCOM also if a Splunk for SCOM App might become available soon.

Ledio_Ago
Splunk Employee
Splunk Employee

maverick
Splunk Employee
Splunk Employee

Perfect! Thanks, Ledio.

0 Karma

Simon_Shelston
Splunk Employee
Splunk Employee

Depends on what you mean by "supports". In the past, Splunk had a "right-click" integration from within System Center where some key and value (server name, IP, etc) was used to open an IE browser with a pre-populated Splunk web search URL. This was mostly done to enable investigations around pre-built SCOM views.

In regards to a SCOM "app", don't expect that any time soon. You can however use PowerShell to wrap Splunk's APIs to bring in data into custom views.

If you're referring to indexing the data that SCOM lives on, you can easily use Splunk's WMI input to capture the same Event Log or "perfmon" data.

Simon_Shelston
Splunk Employee
Splunk Employee

Yes, in Splunk 3.3+ there was a SCOM directory under /etc/apps/windows that contained the config and scripts to do this right-click function.

0 Karma

maverick
Splunk Employee
Splunk Employee

Thanks!

When you say "In the past, Splunk had..." do you mean in 3.4.x version or something else?

0 Karma

Justin_Grant
Contributor

What kind of integration are you looking for? Could you edit your question to discuss the kinds of integration you think would make the most sense?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!