I appreciate all your help jplumsdaine22. After a long google search, I added: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 to the scom_command_loader.ps1 file and the SSL issue went away. I can now see data coming into my Splunk Enterprise, but this seems like information about alerts. I'm was expecting to be able to see information relating to the status of devices that are managed in SCOM .. is this something I would have to create a dashboard or visual display of the data we want to view? ... View more

Thanks for your reply. SCOM operations console connects to our management server and pulls through alerts which we can see in Operations Console. That side of connectivity is all working. I am searching on Server B but cannot get any information, I am searching with both Search & Reporting and using the Data Summary. I have also tried installing the Splunk add-on on Server B and try to search with that. In addition, when I go to Add Data>Forward, there is no forwarders configured. Is there a way I can check to see if the data is actually being forwarded? Other than enabling the reciving port on Server B and installing the addon, is there anything else that needs to be done here? We just want to get a understanding of how the process works and what our data looks like in Splunk, but it seems to be proving a bit difficult. Many thanks for your help ... View more

Thanks for your reply. I have installed the heavy forwarder (Splunk Enterprise) on the same machine we run SCOM operations console. (Server A) I have then installed Splunk Enterprise on our receiving machine. (Server B) On Server A, I have configured the forwarder to IP:9997 where IP is Server B's address. On Server B, I have enabled receiving on port 9997. On Server A, when I use the addon to search it cant find anything. I have followed all the guides. Can you advise more on the search head as this is something I haven't done? In addition, according to the logs. This is the error message I am getting: 017-10-05 04:46:01 -04:00 [ log_level=ERROR pid=17432 input=_Splunk_TA_microsoft_scom_internal_used_Events ] New SCOMManagementGroupConnection Fail: The request was aborted: Could not create SSL/TLS secure channel. at newSCOMManagementGroupConnection, C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-scom\bin\scom_command_loader.ps1: line 737 at run, C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-scom\bin\scom_command_loader.ps1: line 562 at , C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-scom\bin\scom_command_loader.ps1: line 813 at , : line 1 at , : line 46 at Microsoft.PowerShell.Commands.WebRequestPSCmdlet.GetResponse(WebRequest request) at Microsoft.PowerShell.Commands.WebRequestPSCmdlet.ProcessRecord() 2017-10-05 04:46:01 -04:00 [ log_level=WARN pid=17432 input=_Splunk_TA_microsoft_scom_internal_used_Events ] End SCOM TA ... View more

This is where I get confused, as I have installed the SCOM-ADD-ON on Splunk Enterprise (as Splunk Enterprise is the same install as heavy forwarder - see above). Therefore I am not sure what you mean when you say install the addon on the heavy forwarder. I have enabled the inputs within the addon as well as configuring the server address. Within the Forwarding and Receiving section: Configured the receiving port to be 9997 Configured forwarding to be the IP:9997 where IP is the machine address From all of this, I dont see how SCOM sends info in also how does port 9997 relate. Thanks for your help so far, really appreciate it! ... View more

Thanks for your answers. So I have installed Splunk Enterprise on our server where Operations Console is installed. I have followed the guide for heavy forwarder but I am unable to get any data coming in. That said, how does SCOM actually send the data in? I haven't configured anything in SCOM to do this? ... View more

Thanks for your reply, I have this already installed on a server. My question was does Splunk Enterprise have to be on the same server as where SCOM is installed? I understand that the Heavy forwarder is a full Splunk install. I am trying to avoid installing Splunk on the same machine as SCOM due to limited resources on that server to run both applications. Therefore, is it possible to have: (Server A) - where SCOM is installed talk to (Server B) - where Splunk Enterprise is installed and if so how would I do that, as the heavy forwarder suggests both applications have to be on the same machine? Many thanks ... View more

How would I do that? Is there any instructions I can follow? This is our first integration with Splunk. Would this mean that Splunk Enterprise would have to be on the same server that we run SCOM on? ... View more

Also is it possible to add a 'pcap' file and view it in Splunk through dashboards? I've uploaded it via Settings>Data input but cannot see anything, I have also installed Splunk for PCAP files but no success? ... View more

Thanks for your answer. I have installed the forwarder + Splunk Enterprise on a server we have. How do I configure it to receive information from my NetFlow appliance, or is it just the case of me sending this information to the IP address + port number of the server that forwarder sits on from my appliance? If so, how do I then view this information on Splunk Enterprise? Sorry for all the questions, this is something new to us. ... View more