Hi all, Rookie Splunk question here 🙂 In my previous life I worked mostly with Tivoli, so this Splunk world is still pretty new to me and I’m trying to understand the best practices. I have installed the Splunk Add‑on for Microsoft SCOM and I’m receiving SCOM data into a dedicated SCOM index. I can also see the events on the ITSI side, so the integration itself seems to be working fine. I have a couple of questions: 1) Duplicate events from two Heavy Forwarders I currently have two Windows Heavy Forwarders, both configured with HEC and the SCOM Add‑On. Now all SCOM events appear to be duplicated, as they are coming in through both HEC endpoints. Is this expected behavior? Is this considered a feature (for HA), or am I doing something wrong? What is the best practice here: active/passive HF, SCOM Add‑On only on one HF, or some other recommendation? 2) ITSI SCOM integration search – enrichment not applied to all events I have done some event enrichment in the SCOM Integration Search in ITSI (for example: assigning responsible team, routing info, etc.). However, it looks like not all events are enriched, and I can’t really figure out why: Some events get the enrichment as expected Some do not, even though they look similar Is this the correct place to do the enrichment, or am I missing something about how the SCOM Integration Search works? Any guidance or pointers would be greatly appreciated. Thanks in advance!
... View more
