All Apps and Add-ons

Why am I unable to get Performance data from Microsoft SCOM 2012?

srinivkris
New Member

Hi,

I am new to Splunk. Please need your suggestion on this issue.

Post integration of Microsoft SCOM 2012 with Splunk Cloud (6.5.0), I can see various events being collected except for the "performance" data. According to the log file 'ta_scom', another input named "_Splunk_TA_microsoft_scom_internal_used_Performance' is running". Please suggest, how do I fix the same?

2017-04-17 16:30:00 -04:00 [ log_level=WARN pid=17228 input=_Splunk_TA_microsoft_scom_internal_used_Performance ] Start SCOM TA
2017-04-17 16:30:01 -04:00 [ log_level=WARN pid=17228 input=_Splunk_TA_microsoft_scom_internal_used_Performance ] There is another input named '_Splunk_TA_microsoft_scom_internal_used_Performance' is running. This round just exits
2017-04-17 16:30:01 -04:00 [ log_level=WARN pid=17228 input=_Splunk_TA_microsoft_scom_internal_used_Performance ] End SCOM TA

Thank you.

Regards,
Srini

0 Karma

hmaldonado_splu
Splunk Employee
Splunk Employee

Regarding the TA for SCOM, the inputs need to finish before firing again. The performance input is particularly verbose, as the documentation says to expect up to 20 minutes for the performance input to finish collecting data the first time that it is fired.
https://docs.splunk.com/Documentation/AddOns/latest/MSSCOM/Configureinputs

If any of the inputs for this TA do not finish prior to being called to run again, you will see the error message referenced in the first post of this page. I can say that I have seen the performance input take up to 40 minutes to finish its initial pull of data with subsequent pulls taking up to 20 minutes depending on the amount of data being collected.

Regards,
Hans

0 Karma

dsoni_splunk
Splunk Employee
Splunk Employee

Hi Srini,

I need some more information over here like
How many agents are they collecting data for ?
The logs mentioned above says one input for performance is already running and it's not completed yet and hence the next round just exits. Moreover only after the previous round is completed the data will start getting indexed and the next round will be invoked.

I hope that would make sense.

0 Karma

srinikris
Engager

Hi,

I had logged a case with Splunk and they updated that Splunk Add-on for Microsoft SCOM was out-dated, hence, there were some issues with data collection. Later, we dropped the plan of collecting data from SCOM.

Please check with Splunk support team as there might be some solution now.

Regards,
Srinivas

hettervik
Builder

Thanks! I've sent a case to Splunk. Hopefully there is a fix for this. 🙂

0 Karma

nirmalrajneupan
Explorer

Hello Hettervi, were you able to find a fix? Running into the same errors.

0 Karma

hettervik
Builder

Hi. No fix as of yet. I got the following answer from Splunk when asking about the issue: "We do have a dev team that is actively working on SCOM v2.2.0. I’ve reached out to them asking if this is one of the bugs that they are planning to fix in the upcoming release, and I’ll circle back to you when I hear back."

0 Karma

nirmalrajneupan
Explorer

Did they provide any workarounds?

0 Karma

hettervik
Builder

No, unfortunately not. They haven't gotten back to me on the case.

0 Karma

hettervik
Builder

Hi! Did you ever found out why you were getting this error message? I've seem to encountered the same problem unfortunately.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...