All Apps and Add-ons

How is this properly scaled to muliple SQL servers?

oagtexas
Explorer

I have it working great on a single SQL server, but DB Connect will not read the second set of stanzas that I added to the inputs.conf that uses the second DB Connect connection.

Common sense tells me that this won't work because each stanza in a single inputs.conf needs (I believe) to be unique. So, how are you guys scaling this out to multiple SQL servers via a single inputs.conf?

In DB Connect, I have one Identity and 2 Connections for each server.

0 Karma

samk
New Member

I've got the same problem.

What I've been doing is namespaceing the inputs by server and database. You could potentially also namespace by instance name if your SQL deployment is that complex.

I've got some scripts which generate the input definitions from a list of server and database names. I also namespace my connections by server and database name, so each database has it's own connection definition, and I pass that in as the connection for each of my inputs.

So basically my input definitions look like this, for the inputs that are 'per database':

[mi_input://mssql:database:dm_db_file_space_usage:<server>:<database>]
connection = <server>.<database>
index = main
interval = 300
max_rows = 10000
mode = batch
output_timestamp_format = YYYY-MM-dd HH:mm:ss
query = SELECT *,CONVERT(varchar(128),SERVERPROPERTY('ServerName')) AS ServerName, db_name() AS DatabaseName FROM sys.dm_db_file_space_usage
source = dbx2:mssql:database:dm_db_file_space_usage:<server>:<database>
sourcetype = mssql:database:dm_db_file_space_usage
ui_query_mode = advanced
disabled = 1

It's probably not the best solution. It would be nice if the query just selected information for all databases on the server. I'm sure it's possible to do this with some clever SQL query and I'd like to see this in a new version of the MSSQL server splunk add-on.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...