All Apps and Add-ons

How is this properly scaled to muliple SQL servers?

oagtexas
Explorer

I have it working great on a single SQL server, but DB Connect will not read the second set of stanzas that I added to the inputs.conf that uses the second DB Connect connection.

Common sense tells me that this won't work because each stanza in a single inputs.conf needs (I believe) to be unique. So, how are you guys scaling this out to multiple SQL servers via a single inputs.conf?

In DB Connect, I have one Identity and 2 Connections for each server.

0 Karma

samk
New Member

I've got the same problem.

What I've been doing is namespaceing the inputs by server and database. You could potentially also namespace by instance name if your SQL deployment is that complex.

I've got some scripts which generate the input definitions from a list of server and database names. I also namespace my connections by server and database name, so each database has it's own connection definition, and I pass that in as the connection for each of my inputs.

So basically my input definitions look like this, for the inputs that are 'per database':

[mi_input://mssql:database:dm_db_file_space_usage:<server>:<database>]
connection = <server>.<database>
index = main
interval = 300
max_rows = 10000
mode = batch
output_timestamp_format = YYYY-MM-dd HH:mm:ss
query = SELECT *,CONVERT(varchar(128),SERVERPROPERTY('ServerName')) AS ServerName, db_name() AS DatabaseName FROM sys.dm_db_file_space_usage
source = dbx2:mssql:database:dm_db_file_space_usage:<server>:<database>
sourcetype = mssql:database:dm_db_file_space_usage
ui_query_mode = advanced
disabled = 1

It's probably not the best solution. It would be nice if the query just selected information for all databases on the server. I'm sure it's possible to do this with some clever SQL query and I'd like to see this in a new version of the MSSQL server splunk add-on.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...