Lookups for the Splunk Add-on for Microsoft SQL Server
Starting with version 3.0.0 of the Splunk Add-on for Microsoft SQL Server, the lookup is not required, as the port field is included in the raw event. To get the port field from previously indexed events, perform the following steps to update the lookup.
Supply the port values for each of your database servers. This step is required to integrate with Splunk IT Service Intelligence.
- On your search head, navigate to
sqlserver_host_dbserver_lookup.csvwith a text editor.
- Edit the file to include the correct port values for each
database_instancein your event data. For example, see the following table:
database_instance port MSSQL-19 1433
- Save the file.
- Restart the search head.
- Repeat for each search head.
Troubleshoot the Splunk Add-on for Microsoft SQL Server
This documentation applies to the following versions of Splunk® Supported Add-ons: released