"One of the challenges I have noted with GNIP is that when the feed gets interrupted they seem to add a timestamp that relates to transmit time rather than the original composition time. It might be good to find a way to anticipate that situation, so…"
We've been working hard since last year pulling together an analytic architecture leveraging Splunk as a foundation architecture, a variety of data providers, and downstream execution platforms (e.g. Ad-Tech, Visualization/BI, Logistics, etc.). Our proprietary addition to this architecture is a suite of data management, analytic, and intelligence applications that ride on Splunk and pull the architecture together. Our first full component leveraging the architecture is now in beta, a Twitter…See More
I don't know customers who are pulling SCOM alert data into Splunk specifically, but I am familiar with other customers writing a file as an output which is then ingested by SCOM as one way. This won't persist alert data however. A second way, and one more preferred requires SCOM R2 to enable objects in SCOM to search Splunk using a search string. Results populate in SCOM, and everyone is happy. I am sure that Splunk can interact with the SCOM API, though I have not done it yet myself. What version of SCOM are you using?
I use SCOM R2.
I think about using script to mining data from SCOM database (MSSQL Server) and get the specific table that SCOM use to record the log or data about servers it manage, but not to sure if this can done, since i don't know exactly how to mining data from database server using bat script. If this method is right, can anyone share about this? Thanks