We have Splunk Enterprise 6.6.3 running on Linux (1 Search Head + 1 Indexer).
We have installed Splunk Add-on for Microsoft SCOM 2.1.0.
We experiment difficulties configuring the data inputs to collect data from the SCOM server. When saving the data inputs we always get:
"External handler failed with code '1' and output: 'REST ERROR[400]: Bad Request - cannot write to inputs.conf stanza=_Splunk_TA_microsoft_scom_internal_used_Blabla'. See splunkd.log for stderr output."
The installation guide (http://docs.splunk.com/Documentation/AddOns/released/MSSCOM/Install) says to install the Add On on the Search Head which we did.
The requirements (http://docs.splunk.com/Documentation/AddOns/released/MSSCOM/Hardwareandsoftwarerequirements) says that "to collect data, the Splunk Add-on for Microsoft SCOM must be installed on a Splunk Enterprise forwarder or single instance Splunk Enterprise that is installed on the same machine as your Microsoft System Center Operations Manager 2012 R2 Operations console"
Can you help?
... View more