All Apps and Add-ons

SCCM App for Splunk: Why am I getting create collection lookup error "command="dbquery", A database error occurred: Invalid object name..."?

Path Finder

I'm going through the dev post found here - http://devpost.com/software/splunk-sccm-64z3c

This may be my inexperience with Splunk or general vagueness of the instructions. Not sure which but I have Splunk DB Connect set up and connected to my SCCM database. The SCCM app is installed then I get hung up on step 6 which says:

Step 6- In the sccm directory it creates, you will find a inputs.conf file in the root of the directory. DBConnect does not recognize dmon-tail inputs from the app, so you will need to add the stanzas to your inputs.conf located in /opt/splunk/etc/apps/dbx/local or C:\Program Files\Splunk\etc\apps\dbx\local directory.

What stanzas do I need to add?

Again this is probably simple, but given my lack of Splunk knowledge, I'm stuck here.

Any help or guidance is appreciated.

Thanks.

0 Karma
1 Solution

Path Finder

Setup a Splunk instance on Windows and the app worked perfectly immediately after setup.

Not sure if it's conclusive but this app doesn't appear to play nicely with Linux.

View solution in original post

0 Karma

Path Finder

Setup a Splunk instance on Windows and the app worked perfectly immediately after setup.

Not sure if it's conclusive but this app doesn't appear to play nicely with Linux.

View solution in original post

0 Karma

Path Finder

I created my read_only account, for the SCCM app to use, with the Default database in SQL set to Master instead of the SCCM database.

I changed the Default database setting and re-saved the external database setup in Splunk The reports in the SCCM app starting working correctly.

The dashboards are still not populating data however...on to the next step.

0 Karma

Path Finder

I found the error in my ways there. The stanzas within sccm's inputs.conf file need to be copied into /opt/splunk/etc/apps/dbx/local/inputs.conf to create the database inputs. Make sense now.

On to the next problem.

When running the lookup reports in the sccm app i get zero results found for the Locations lookup.

The create collection membership lookup gives me this error - command="dbquery", A database error occurred: Invalid object name 'v_ClientCollectionMembers'

create collection lookup gives this error - command="dbquery", A database error occurred: Invalid object name 'v_Collection'

0 Karma

Path Finder

This is the query the app is trying to run. Pulled it from the apps macros.conf file.

dbquery sccm_database SELECT collectionid, resourceid FROM vClientCollectionMembers | outputlookup sccmcollectionmembership.csv

sccm_database points to the correct database and db connect validates that connection when adding it.

I can run the SQL query against the database manually and it returns data correctly.

SELECT collectionid, resourceid FROM v_ClientCollectionMembers

Everything checks out so I'm still at a loss as to why the app would comeback with invalid object name. Unless it's something to do with it being SQL Server 2012 and DB Connect 1.

In the event anyone is having similar issues I'll continue to update this thread.

0 Karma