All Apps and Add-ons

How is this properly scaled to muliple SQL servers?

oagtexas
Explorer

I have it working great on a single SQL server, but DB Connect will not read the second set of stanzas that I added to the inputs.conf that uses the second DB Connect connection.

Common sense tells me that this won't work because each stanza in a single inputs.conf needs (I believe) to be unique. So, how are you guys scaling this out to multiple SQL servers via a single inputs.conf?

In DB Connect, I have one Identity and 2 Connections for each server.

0 Karma

samk
New Member

I've got the same problem.

What I've been doing is namespaceing the inputs by server and database. You could potentially also namespace by instance name if your SQL deployment is that complex.

I've got some scripts which generate the input definitions from a list of server and database names. I also namespace my connections by server and database name, so each database has it's own connection definition, and I pass that in as the connection for each of my inputs.

So basically my input definitions look like this, for the inputs that are 'per database':

[mi_input://mssql:database:dm_db_file_space_usage:<server>:<database>]
connection = <server>.<database>
index = main
interval = 300
max_rows = 10000
mode = batch
output_timestamp_format = YYYY-MM-dd HH:mm:ss
query = SELECT *,CONVERT(varchar(128),SERVERPROPERTY('ServerName')) AS ServerName, db_name() AS DatabaseName FROM sys.dm_db_file_space_usage
source = dbx2:mssql:database:dm_db_file_space_usage:<server>:<database>
sourcetype = mssql:database:dm_db_file_space_usage
ui_query_mode = advanced
disabled = 1

It's probably not the best solution. It would be nice if the query just selected information for all databases on the server. I'm sure it's possible to do this with some clever SQL query and I'd like to see this in a new version of the MSSQL server splunk add-on.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...