SQL queries for SCOM direct events processing reference

The SQL queries provided with the Splunk Add-on for Microsoft SCOM might overload your SCOM Server or Splunk instances.

Splunk support may not be able to assist in cases where you modified your SQL queries. Splunk best practice is to exercise extreme caution during modification of provided SQL queries.

1. Number of columns are modified at the SQL level for compatibility with scriptlet based source types (All the invocations of ISNULL and LOWER methods).
2. Number of hard coded columns (splunk_scom_group, scom_command) looks redundant but are required for valid Data Model mapping.
3. Removal of double quotes from search results: this operation is required to alleviate a known Splunk DB Connect issue: Incomplete field values are extracted when the value contains double quotes