Why am I unable to get Performance data from Microsoft SCOM 2012?

[srinivkris]

Hi,

I am new to Splunk. Please need your suggestion on this issue.

Post integration of Microsoft SCOM 2012 with Splunk Cloud (6.5.0), I can see various events being collected except for the "performance" data. According to the log file 'ta_scom', another input named "_Splunk_TA_microsoft_scom_internal_used_Performance' is running". Please suggest, how do I fix the same?

2017-04-17 16:30:00 -04:00 [ log_level=WARN pid=17228 input=_Splunk_TA_microsoft_scom_internal_used_Performance ] Start SCOM TA
2017-04-17 16:30:01 -04:00 [ log_level=WARN pid=17228 input=_Splunk_TA_microsoft_scom_internal_used_Performance ] There is another input named '_Splunk_TA_microsoft_scom_internal_used_Performance' is running. This round just exits
2017-04-17 16:30:01 -04:00 [ log_level=WARN pid=17228 input=_Splunk_TA_microsoft_scom_internal_used_Performance ] End SCOM TA

Thank you.

Regards,
Srini

[hmaldonado_splu]

Regarding the TA for SCOM, the inputs need to finish before firing again. The performance input is particularly verbose, as the documentation says to expect up to 20 minutes for the performance input to finish collecting data the first time that it is fired.
https://docs.splunk.com/Documentation/AddOns/latest/MSSCOM/Configureinputs

If any of the inputs for this TA do not finish prior to being called to run again, you will see the error message referenced in the first post of this page. I can say that I have seen the performance input take up to 40 minutes to finish its initial pull of data with subsequent pulls taking up to 20 minutes depending on the amount of data being collected.

Regards,
Hans

[dsoni_splunk]

Hi Srini,

I need some more information over here like
How many agents are they collecting data for ?
The logs mentioned above says one input for performance is already running and it's not completed yet and hence the next round just exits. Moreover only after the previous round is completed the data will start getting indexed and the next round will be invoked.

I hope that would make sense.

[srinikris]

Hi,

I had logged a case with Splunk and they updated that Splunk Add-on for Microsoft SCOM was out-dated, hence, there were some issues with data collection. Later, we dropped the plan of collecting data from SCOM.

Please check with Splunk support team as there might be some solution now.

Regards,
Srinivas

[hettervik]

Thanks! I've sent a case to Splunk. Hopefully there is a fix for this. 🙂

[nirmalrajneupan]

Hello Hettervi, were you able to find a fix? Running into the same errors.

[hettervik]

Hi. No fix as of yet. I got the following answer from Splunk when asking about the issue: "We do have a dev team that is actively working on SCOM v2.2.0. I’ve reached out to them asking if this is one of the bugs that they are planning to fix in the upcoming release, and I’ll circle back to you when I hear back."

[nirmalrajneupan]

Did they provide any workarounds?

[hettervik]

No, unfortunately not. They haven't gotten back to me on the case.

[hettervik]

Hi! Did you ever found out why you were getting this error message? I've seem to encountered the same problem unfortunately.