All Apps and Add-ons

Why does the database tag return nothing with Splunk ITSI when using Splunk Add-on for SQL Server?

Kendo213
Communicator

I have the Splunk Addon for SQL Server installed on some SQL servers and search heads. We have active SQL servers sending in data, however none of it is being tagged as database by Splunk ITSI / the TA. Because of this, none of the default built-in KPIs for database are working in ITSI (tag=database returns nothing).

Any ideas?

1 Solution

skoelpin
SplunkTrust
SplunkTrust

The short answer is, you should not use the out-of-box database service. A few reasons for this is, you can't modify any of the KPI's, it's default to run every minute, and it depends on tags to get its data which in-turn has higher performance issues. A better solution would be to clone that service and add new searches that don't rely on tags.

If you were 100% committed to using the out-of-box services, you could tag your events on the forwarder so the out-of-box KPI's will populate

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

The short answer is, you should not use the out-of-box database service. A few reasons for this is, you can't modify any of the KPI's, it's default to run every minute, and it depends on tags to get its data which in-turn has higher performance issues. A better solution would be to clone that service and add new searches that don't rely on tags.

If you were 100% committed to using the out-of-box services, you could tag your events on the forwarder so the out-of-box KPI's will populate

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...