Learning, learning, learning . . . Our Splunk "expert" is gone, and the non-programmer gets to learn the task! How do you spell SPLUNK?
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde commented on Michael Wilde's video
Sure... When you do group mapping, map them to groups that don't have the domain admins in them. I have a separate OU=Groups that has "Splunk Users, Splunk Admins, Splunk Power Users" as group names, and specific users…
Mike Hartford commented on Michael Wilde's video
I want to give LDAP access to my splunk servcie but I don't want the LDAP users to have admin capabilitys in Splunk. Can I keep the domain admins out of Splunk if I have LDAP authentication???
Mike Hartford left a comment for Jonathan Hawes
Helow Jonathan,
Glad to have another Splunker. I've been useing Splunk for 2 years and am hooked. I leared how to spell splunk and | transaction too. you'll learn that one soon.
Go over to Splunk…
Mike Hartford commented on Mike Hartford's blog post 'tees for the holy day'
Holy Batskins Ninja, zzzzzwap zgruppp kapow a hidden stash, how great is that!!!!
The team that found them must have special bat senses and highly tooned Splunking skills
I like to wear Extra Lovable…
Splunk with SCOM
Hi, i wanna ask if anyone has experience in get data from all windows server managed by SCOM (System Center Operations Manager)?
Please guide me. Thanks
Please guide me. Thanks
Tags: SCOM
Views: 36
Replies to This Discussion
-
Permalink Reply by Michael Wilde on -
Andi...
Is your hope to pull all the event data directly from SCOM? Or are do you just need to get eventlogs from each server?
-
Permalink Reply by Andi Susanto on -
Hi Michael, thanks for reply,
we need to pull all the event data directly from SCOM.
Our client have many server that monitored by SCOM
They really want to use Splunk to get the all server data that had pulled by SCOM.
They want to combine, not replace the SCOM with splunk.
Any clue for this?
Thx.
-
Permalink Reply by Andi Susanto on
-
Any answer for this topic?
-
Permalink Reply by Kung FuSchnickens on
-
I don't know customers who are pulling SCOM alert data into Splunk specifically, but I am familiar with other customers writing a file as an output which is then ingested by SCOM as one way. This won't persist alert data however. A second way, and one more preferred requires SCOM R2 to enable objects in SCOM to search Splunk using a search string. Results populate in SCOM, and everyone is happy. I am sure that Splunk can interact with the SCOM API, though I have not done it yet myself. What version of SCOM are you using?
-
Permalink Reply by Andi Susanto on
-
I use SCOM R2.
I think about using script to mining data from SCOM database (MSSQL Server) and get the specific table that SCOM use to record the log or data about servers it manage, but not to sure if this can done, since i don't know exactly how to mining data from database server using bat script. If this method is right, can anyone share about this? Thanks
© 2012 Created by Michael Wilde.
