Splunk® Supported Add-ons

Splunk Add-on for Microsoft SQL Server

Lookups for the Splunk Add-on for Microsoft SQL Server

Starting with version 3.0.0 of the Splunk Add-on for Microsoft SQL Server, the lookup is not required, as the port field is included in the raw event. To get the port field from previously indexed events, perform the following steps to update the lookup.

Supply the port values for each of your database servers. This step is required to integrate with Splunk IT Service Intelligence.

  1. On your search head, navigate to %SPLUNK_HOME%\etc\apps\Splunk_TA_microsoft-sqlserver\lookups\.
  2. Open sqlserver_host_dbserver_lookup.csv with a text editor.
  3. Edit the file to include the correct port values for each database_instance in your event data. For example, see the following table:
    database_instance port
    MSSQL-19 1433
  4. Save the file.
  5. Restart the search head.
  6. Repeat for each search head.
Last modified on 24 July, 2024
Troubleshoot the Splunk Add-on for Microsoft SQL Server  

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters