another question. I have made the powershell script populate the time as LocalTime by doing this: $scomdate = ($event.TimeGenerated).ToLocalTime(); write-host $scomdate; this is required as my local timezone is UTC+13 and the date arrives at splunk as text like this: 30-10-2012 3:10:29 p.m. this works fine in the morning, however... once the dates go past 1pm, they get logged as if they were a.m, instead of p.m i.e the text in the event is 30-10-2012 3:10:29 p.m. but the logged time for the event is 30/10/2012 03:10:29.000 my props.conf is like this: [source::SCOM...] SHOULD_LINEMERGE = false TIME_FORMAT=%d-%m-%Y %I:%M:%S %p MAX_TIMESTAMP_LOOKAHEAD=43 any ideas how I force splunk to correctly apply the a.m and p.m ? ... View more

I now have this working. My issue was one of credentials. My splunk install on windows was running splunkd as LocalSystem, but my own user account doing the testing was the one which had permission to access the SCOM server via powershell. To see the actual error I had to start a powershell session using AT, then manually run the powershell script. My workaround for now is I have changed the splunkd service to run under my own user account. Also, one improvement to the code. in scom_client.ps1 make the following change: #write-host ("ComputerName=" + $alert.MonitoringObjectDisplayName); write-host ("ComputerName=" + $alert.NetbiosComputerName); this is more accurate, as the monitoring object display name can contain things like "Terminal Services" and other such objects. Sadly it isn't a full fix, and some alert types are not related to hosts, such as Active Directory objects etc. I'll post a better solution shortly. ... View more

thanks for the info. I have now narrowed this down to a difference between how splunk reads file paths, compared to how powershell reads file paths. i.e parts of the powershell script can find the file when run manually, but when splunk runs the same script, it can't find the file. I'll keep testing variations on this, and post the final config changes once I have it working. ... View more

log output.. all seems well.. 02-10-2012 1:22:39 p.m. INFO Alerts checkpoint loaded successfully 02-10-2012 1:22:39 p.m. DEBUG Get-Alert -criteria "TimeRaised > '10/01/2012 21:50:04' AND Severity = '2'" 02-10-2012 1:22:40 p.m. DEBUG Forwarding 125 alert(s) however.. this mention of 'Forwarding' is only a log entry. the 'action' to forward it to splunk is only the write-host action within powershell. My main question is therefore : what configuration within the app actually tells splunk to look for the output from the powershell command? ... View more

thanks. feedback below. 1:yes, 2:yes, 3:yes 4:this doesn't run, but most likely this is due to syntax which isn't supported via the command line in windows: $SystemRoot\ and $SPLUNK_HOME. I assume these should be environment variables like %SystemRoot%. I have change this to %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'C:\Program Files\Splunk\etc\apps\scom\bin\scom_client.ps1'" which runs ok, gets data, updates the checkpoint file and the log file. 5:loggin already enabled... will put output into next comment.. ... View more

Right now I'm in testing mode. Local install of splunk on windows box which also has the scom console components installed. powershell query works fine and retries alert data when run manually in a powershell session. scom server is remote to this computer. Once I get it working then I'll move to install a splunk forwarder on the scom server, but for now splunk is local and scom is remote. I could always just change the powershell script to write each alert to a file which splunk could index.. but I still think I'm missing something in the initial app config.. ... View more

sorry, I should have mentioned I am trying to get the scom app working: "http://splunk-base.splunk.com/apps/22380/scom-system-center-operations-manager-integration". All is set up fine, the powershell queries work, logging is ok, but no data reaches splunk. In reverse engineering the scom_client.ps1 file. the only 'forwarding' that happens is a write-host of the data to the powershell console. There seems to be a gap.. i.e it is unclear how splunk would ever notice this write-host unless it monitors this output by default by virtue of splunk calling the powershell session. ... View more