Splunk Observability Cloud MS SQL Server Monitor Discovery error

[Arun2]

Hi Team,

I am exploring the splunk Observability CLoud with MS SQL Server Monitor. Collector has been deployed with required config.yaml file. 

Database Instance detail started populating with Query metrics and others. But I am seeing below error in Event Viewer. Any idea what is this user doing?

I am unable to view Database details, not sure if this is because of this error.

How to fix this, If I have to create a user splunk.discovery.default , how and where to pass the credentials? If not how to disable this auto discovery?

Already I have created an user and pa

Login failed for user 'splunk.discovery.default'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]

[bishida]

Hi,
It sounds like you already got your SQL server receiver configured and working in your agent_config.yaml, but now you need to turn off autodiscovery to avoid that message. 

If that is accurate, then edit your /etc/otel/collector/splunk-otel-collector.conf file and remove the discovery flag from OTELCOL_OPTIONS.

For Windows, same idea, but you'll find OTELCOL_OPTIONS in the Env variable in regedit for the Splunk OTel service (HKLM:\SYSTEM\CurrentControlSet\Services\splunk-otel-collector -> Environment)

You'll need to restart the collector after fixing that value.

[Arun2]

@bishida , Thanks for your update. 

This variable is not found in registry OTELCOL_OPTIONS under the given path.

But in imagePath value the startup command had a syntax of --discovery, I updated it to --discovery=false. After restart the error stopped.

In case if we want to use Auto discovery , is this the default user splunk.discovery.default and need to provide permission from sql end. Couldnt find any documenation related to this, if you have any more detail on this could you share.

[bishida]

Hi,

That sounds good that you got it fixed another way. For future reference, since you're working with Windows registry, if you want to adjust OTELCOL_OPTIONS, you can add it if there's currently no value. 

In RegEdit -> HKLM\SYSTEM\CurrentControlSet\Services\splunk-otel-collector, there is a multi-string key named "Environment". You can add OTELCOL_OPTIONS as one of the lines.

Since you already know your host is running SQL Server, there probably isn't much value in you using autodiscovery in that case. For most databases, the autodiscovery is detecting the use of standard ports and process names to bring to your attention that it's something that can be configured to observe. 

In your case, I'd probably just jump ahead to the configuration part and get it working:
https://help.splunk.com/en/splunk-observability-cloud/manage-data/splunk-distribution-of-the-opentel...