All Apps and Add-ons

SCCM App for Splunk: Why am I getting create collection lookup error "command="dbquery", A database error occurred: Invalid object name..."?

adamschmitz
Path Finder

I'm going through the dev post found here - http://devpost.com/software/splunk-sccm-64z3c

This may be my inexperience with Splunk or general vagueness of the instructions. Not sure which but I have Splunk DB Connect set up and connected to my SCCM database. The SCCM app is installed then I get hung up on step 6 which says:

Step 6- In the sccm directory it creates, you will find a inputs.conf file in the root of the directory. DBConnect does not recognize dmon-tail inputs from the app, so you will need to add the stanzas to your inputs.conf located in /opt/splunk/etc/apps/dbx/local or C:\Program Files\Splunk\etc\apps\dbx\local directory.

What stanzas do I need to add?

Again this is probably simple, but given my lack of Splunk knowledge, I'm stuck here.

Any help or guidance is appreciated.

Thanks.

0 Karma
1 Solution

adamschmitz
Path Finder

Setup a Splunk instance on Windows and the app worked perfectly immediately after setup.

Not sure if it's conclusive but this app doesn't appear to play nicely with Linux.

View solution in original post

0 Karma

adamschmitz
Path Finder

Setup a Splunk instance on Windows and the app worked perfectly immediately after setup.

Not sure if it's conclusive but this app doesn't appear to play nicely with Linux.

0 Karma

adamschmitz
Path Finder

I created my read_only account, for the SCCM app to use, with the Default database in SQL set to Master instead of the SCCM database.

I changed the Default database setting and re-saved the external database setup in Splunk The reports in the SCCM app starting working correctly.

The dashboards are still not populating data however...on to the next step.

0 Karma

adamschmitz
Path Finder

I found the error in my ways there. The stanzas within sccm's inputs.conf file need to be copied into /opt/splunk/etc/apps/dbx/local/inputs.conf to create the database inputs. Make sense now.

On to the next problem.

When running the lookup reports in the sccm app i get zero results found for the Locations lookup.

The create collection membership lookup gives me this error - command="dbquery", A database error occurred: Invalid object name 'v_ClientCollectionMembers'

create collection lookup gives this error - command="dbquery", A database error occurred: Invalid object name 'v_Collection'

0 Karma

adamschmitz
Path Finder

This is the query the app is trying to run. Pulled it from the apps macros.conf file.

dbquery sccm_database SELECT collectionid, resourceid FROM v_ClientCollectionMembers | outputlookup sccm_collectionmembership.csv

sccm_database points to the correct database and db connect validates that connection when adding it.

I can run the SQL query against the database manually and it returns data correctly.

SELECT collectionid, resourceid FROM v_ClientCollectionMembers

Everything checks out so I'm still at a loss as to why the app would comeback with invalid object name. Unless it's something to do with it being SQL Server 2012 and DB Connect 1.

In the event anyone is having similar issues I'll continue to update this thread.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...