Does Splunk integrate with or supports Windows SCOM?

[maverick]

Wondering if Splunk integrates with or supports Windows SCOM also if a Splunk for SCOM App might become available soon.

[Ledio_Ago]

Have you seen this:

http://www.splunkbase.com/apps/All/4.x/app:System+Center+Operations+Manager+%28SCOM%29+integration

[maverick]

Perfect! Thanks, Ledio.

[Simon_Shelston]

Depends on what you mean by "supports". In the past, Splunk had a "right-click" integration from within System Center where some key and value (server name, IP, etc) was used to open an IE browser with a pre-populated Splunk web search URL. This was mostly done to enable investigations around pre-built SCOM views.

In regards to a SCOM "app", don't expect that any time soon. You can however use PowerShell to wrap Splunk's APIs to bring in data into custom views.

If you're referring to indexing the data that SCOM lives on, you can easily use Splunk's WMI input to capture the same Event Log or "perfmon" data.

[Simon_Shelston]

Yes, in Splunk 3.3+ there was a SCOM directory under /etc/apps/windows that contained the config and scripts to do this right-click function.

[maverick]

Thanks!

When you say "In the past, Splunk had..." do you mean in 3.4.x version or something else?

[Justin_Grant]

What kind of integration are you looking for? Could you edit your question to discuss the kinds of integration you think would make the most sense?