How to create a dashboard for oracle rman increment backup?

[lousplunk]

I am trying to create a dashboard which shows the oracle increment dashboard. I can see that splunk have a
sourcetype=oracle:rman
I am trying to create a dashboard which shows in a week from Monday-Sunday (daily basis) and how much it backs up.

[nishad_tupe · Accepted solution]

Hi,
I don't think Splunk Oracle Add-On TA App provides the source type oracle:rman.
http://docs.splunk.com/Documentation/AddOns/released/Oracle/Datatypes
There is something called as SYS.UNIFIED_AUDIT_TRAIL with 12c , where Splunk mentions that using oracle:audit:unified may capture Oracle RMAN information.
http://docs.splunk.com/Documentation/AddOns/released/Oracle/Releasenotes

I would suggest creating a custom app and source type to monitor your backup logs. You can write a custom script to extract the necessary information from logs. Use DBX Input to monitor oracleRMAN views (v$backup_files etc) only if you are unable to extract information. I am working on POC to build the dashboard for RMAN backups.

You output log / csv should have roughly these headers.
Instance Host Version Type Level Backup_start_Date Status Message Size_MB Duration_Min

Optionally you can also monitor the archive log gap sequence through logs.

If you happen to know the standard source type provided by Splunk along with configuration inputs please post here.

Regards,
Nishad