Lookups for the Splunk Add-on for Microsoft SQL Server

Starting with version 3.0.0 of the Splunk Add-on for Microsoft SQL Server, the lookup is not required, as the port field is included in the raw event. To get the port field from previously indexed events, perform the following steps to update the lookup.

Supply the port values for each of your database servers. This step is required to integrate with Splunk IT Service Intelligence.

1. On your search head, navigate to %SPLUNK_HOME%\etc\apps\Splunk_TA_microsoft-sqlserver\lookups\.
2. Open sqlserver_host_dbserver_lookup.csv with a text editor.
3. Edit the file to include the correct port values for each database_instance in your event data. For example, see the following table:

   database_instance	port
   MSSQL-19	1433

4. Save the file.
5. Restart the search head.
6. Repeat for each search head.