topic Re: Integrate MSSQL standard edition with Splunk in Security

Integrate MSSQL standard edition with Splunk

Nawab — Tue, 28 Jan 2025 11:01:14 GMT

We need to integrate MSSQL standard edition with splunk, so we tried sending logs to Windows Event Viewer application channel. Now we are getting logs, but the issue is logs are not parsed and we are getting all logs.

My question is if someone has integrated MSSQL standard edition with splunk. how you did it and is data parsed

Re: Integrate MSSQL standard edition with Splunk

PickleRick — Tue, 28 Jan 2025 11:06:11 GMT

The MSSQL Add-On has installation and configuration docs. Did you read them?

https://docs.splunk.com/Documentation/AddOns/released/MSSQLServer/About

Re: Integrate MSSQL standard edition with Splunk

gcusello — Tue, 28 Jan 2025 11:41:54 GMT

Hi @Nawab ,

did you installed the SQL-Server Add-On https://splunkbase.splunk.com/app/2648 on the Search Heads and on the Indexers or (if present) on the Heavy Forwarders?

Ciao.

Giuseppe

Re: Integrate MSSQL standard edition with Splunk

Nawab — Tue, 28 Jan 2025 11:45:29 GMT

No i didnt because there is no sourcetype or input if logs are coming in application channel

Re: Integrate MSSQL standard edition with Splunk

PickleRick — Tue, 28 Jan 2025 12:21:34 GMT

Well, the Add-On for MSSQL is the supported way of getting audit data from MSSQL databases. If you want to do it another way, you're pretty much on your own.

Re: Integrate MSSQL standard edition with Splunk

gcusello — Mon, 10 Feb 2025 07:24:51 GMT

Hi @Nawab ,

you should use the sourcetypes used in the add-on.

Add-on should be installed in the Forwarder used to ingest data and on the Search Heads, used for search tipe parsing activities.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉