I'm going through the dev post found here - http://devpost.com/software/splunk-sccm-64z3c
This may be my inexperience with Splunk or general vagueness of the instructions. Not sure which but I have Splunk DB Connect set up and connected to my SCCM database. The SCCM app is installed then I get hung up on step 6 which says:
Step 6- In the sccm directory it creates, you will find a inputs.conf file in the root of the directory. DBConnect does not recognize dmon-tail inputs from the app, so you will need to add the stanzas to your inputs.conf located in /opt/splunk/etc/apps/dbx/local or C:\Program Files\Splunk\etc\apps\dbx\local
directory.
What stanzas do I need to add?
Again this is probably simple, but given my lack of Splunk knowledge, I'm stuck here.
Any help or guidance is appreciated.
Thanks.
Setup a Splunk instance on Windows and the app worked perfectly immediately after setup.
Not sure if it's conclusive but this app doesn't appear to play nicely with Linux.
Setup a Splunk instance on Windows and the app worked perfectly immediately after setup.
Not sure if it's conclusive but this app doesn't appear to play nicely with Linux.
I created my read_only account, for the SCCM app to use, with the Default database in SQL set to Master instead of the SCCM database.
I changed the Default database setting and re-saved the external database setup in Splunk The reports in the SCCM app starting working correctly.
The dashboards are still not populating data however...on to the next step.
I found the error in my ways there. The stanzas within sccm's inputs.conf file need to be copied into /opt/splunk/etc/apps/dbx/local/inputs.conf to create the database inputs. Make sense now.
On to the next problem.
When running the lookup reports in the sccm app i get zero results found for the Locations lookup.
The create collection membership lookup gives me this error - command="dbquery", A database error occurred: Invalid object name 'v_ClientCollectionMembers'
create collection lookup gives this error - command="dbquery", A database error occurred: Invalid object name 'v_Collection'
This is the query the app is trying to run. Pulled it from the apps macros.conf file.
dbquery sccm_database
SELECT collectionid, resourceid FROM v_ClientCollectionMembers | outputlookup sccm_collectionmembership.csv
sccm_database points to the correct database and db connect validates that connection when adding it.
I can run the SQL query against the database manually and it returns data correctly.
SELECT collectionid, resourceid FROM v_ClientCollectionMembers
Everything checks out so I'm still at a loss as to why the app would comeback with invalid object name. Unless it's something to do with it being SQL Server 2012 and DB Connect 1.
In the event anyone is having similar issues I'll continue to update this thread.