All Apps and Add-ons

Install SCOM Add on with Splunk Enterprise on Linux platform, howto

New Member

We have Splunk Enterprise 6.6.3 running on Linux (1 Search Head + 1 Indexer).

We have installed Splunk Add-on for Microsoft SCOM 2.1.0.

We experiment difficulties configuring the data inputs to collect data from the SCOM server. When saving the data inputs we always get:
"External handler failed with code '1' and output: 'REST ERROR[400]: Bad Request - cannot write to inputs.conf stanza=_Splunk_TA_microsoft_scom_internal_used_Blabla'. See splunkd.log for stderr output."

The installation guide ( says to install the Add On on the Search Head which we did.
The requirements ( says that "to collect data, the Splunk Add-on for Microsoft SCOM must be installed on a Splunk Enterprise forwarder or single instance Splunk Enterprise that is installed on the same machine as your Microsoft System Center Operations Manager 2012 R2 Operations console"

Can you help?

0 Karma

Path Finder

You always want to install the forwarder directly on the source system that is producing the logs - in this case it should be a Windows system running SCOM - so you will need to install some components of the application directly on the SCOM system itself. The forwarder will pick up the logs from SCOM, then forward them to your Linux environment.

So, in this case, I believe you need to install components of the SCOM application in two locations.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...