SOLVED - SQL Hosts dashboard in App for Microsoft SQL Server

[MaverickT]

I was playing with App for Microsoft SQL Server and came around with issue of not displaying hosts in SQL Hosts dashboard. After hour or two of researching (guess what, there is powershell log in splunk log folder) I found the reason for this behavior.

In default input configuration for TA-SQLServer there is small error for the [powershell://HostInformation] stanza.

Correct configuration should be:

[powershell://HostInformation]
script = & "$SplunkHome\etc\apps\TA-SQLServer\bin\Invoke-MonitoredScript.ps1" -Command ".\hostinfo.ps1"
schedule = 30 */15 * ? * *
index = mssql
sourcetype = MSSQL:Host:Information
source = Powershell

So basically there is one (*) missing between */15 and ?. If you correct this configuration and deploy it on your SQL server's forwarders you are good to go. Hope this solves you few headaches.

[sonila]

schedule = 30 */15 * ? * *
all schedule are in this format

[halkelley]

aren't there just 5 parameters? (minute hour day month day-of-week)?