Installation and configuration overview for the Splunk Add-on for Microsoft SCOM

Direct event processing for Microsoft SCOM

One known limitation of the scriptlets used by the Splunk Add-on for Microsoft SCOM is time range filtering - Splunk always receives a complete set of available data and then filters out already processed events. This might affect performance for larger installations.

All the data of the Management Group is stored in the Operational Database. It is hosted on a SQL Server instance and accessed by Management Server and PowerShell cmdlets. The "Direct event processing" feature lets you collect data directly from the database and provides a more flexible and performant solution by having a direct SQL connection.

Still, a scriptlet-based solution shall be the default choice. There isn't a formally documented SCOM Database Schema and can be modified without prior notice. Moreover - due to possible additional post-processing in PowerShell scriptlets - the results may slightly differ between both sources.

See these steps to install and configure this add-on, including direct event processing:

1. Install the Splunk Add-on for Microsoft SCOM.
2. Prerequisites for Splunk Add-on for Microsoft SCOM direct events processing.
3. Configure inputs for the Splunk Add-on for Microsoft SCOM.
4. Configure DB Connect v3 inputs.
5. Migration from scriptlet-based events collection to direct, SQL-based approach.