Install SCOM Add on with Splunk Enterprise on Linux platform, howto

[eboucquey]

We have Splunk Enterprise 6.6.3 running on Linux (1 Search Head + 1 Indexer).

We have installed Splunk Add-on for Microsoft SCOM 2.1.0.

We experiment difficulties configuring the data inputs to collect data from the SCOM server. When saving the data inputs we always get:
"External handler failed with code '1' and output: 'REST ERROR[400]: Bad Request - cannot write to inputs.conf stanza=_Splunk_TA_microsoft_scom_internal_used_Blabla'. See splunkd.log for stderr output."

The installation guide (http://docs.splunk.com/Documentation/AddOns/released/MSSCOM/Install) says to install the Add On on the Search Head which we did.
The requirements (http://docs.splunk.com/Documentation/AddOns/released/MSSCOM/Hardwareandsoftwarerequirements) says that "to collect data, the Splunk Add-on for Microsoft SCOM must be installed on a Splunk Enterprise forwarder or single instance Splunk Enterprise that is installed on the same machine as your Microsoft System Center Operations Manager 2012 R2 Operations console"

Can you help?

[gwalford]

You always want to install the forwarder directly on the source system that is producing the logs - in this case it should be a Windows system running SCOM - so you will need to install some components of the application directly on the SCOM system itself. The forwarder will pick up the logs from SCOM, then forward them to your Linux environment.

So, in this case, I believe you need to install components of the SCOM application in two locations.