https://community.splunk.com/t5/All-Apps-and-Add-ons/Will-the-Splunk-Add-on-for-Microsoft-SQL-Server-suffice-to/m-p/301508#M35979 <P>You have two choices that I'm aware of to obtain the SQL server audit logs, send the logs to the security event viewer and attempt to read them through from there.<BR /> Or send them to a binary audit file.</P> <P>The binary audit file requires a connection to SQL server to read the data from it, at the time of writing the documentation for sys.fn_get_audit_file is <A href="https://docs.microsoft.com/en-us/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql" target="_blank">here</A> , if you want to connect to an SQL server to read the binary audit file you <STRONG>will</STRONG> need the DB connect app to perform the connection.</P> <P>The app for Microsoft SQL server can help with tagging the relevant fields for CIM compatibility.</P> Tue, 29 Sep 2020 16:12:49 GMT gjanders 2020-09-29T16:12:49Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Will-the-Splunk-Add-on-for-Microsoft-SQL-Server-suffice-to/m-p/301507#M35978 <P>I wish to get only user access logs from SQL Server. Basically, who accesses what database at what time. </P> <P>For this purpose, is the Splunk add on for microsoft sql server enough or DB Connect is also required ?</P> <P>My understanding is that I could be able to get the user access info from AUDIT LOG but I am uncertain about that.</P> Mon, 09 Oct 2017 23:01:56 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Will-the-Splunk-Add-on-for-Microsoft-SQL-Server-suffice-to/m-p/301507#M35978 damode 2017-10-09T23:01:56Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Will-the-Splunk-Add-on-for-Microsoft-SQL-Server-suffice-to/m-p/301508#M35979 <P>You have two choices that I'm aware of to obtain the SQL server audit logs, send the logs to the security event viewer and attempt to read them through from there.<BR /> Or send them to a binary audit file.</P> <P>The binary audit file requires a connection to SQL server to read the data from it, at the time of writing the documentation for sys.fn_get_audit_file is <A href="https://docs.microsoft.com/en-us/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql" target="_blank">here</A> , if you want to connect to an SQL server to read the binary audit file you <STRONG>will</STRONG> need the DB connect app to perform the connection.</P> <P>The app for Microsoft SQL server can help with tagging the relevant fields for CIM compatibility.</P> Tue, 29 Sep 2020 16:12:49 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Will-the-Splunk-Add-on-for-Microsoft-SQL-Server-suffice-to/m-p/301508#M35979 gjanders 2020-09-29T16:12:49Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Will-the-Splunk-Add-on-for-Microsoft-SQL-Server-suffice-to/m-p/301509#M35980 <P>Hi @garethatiag,</P> <P>Sorry for late reply to this post and thanks for your answer.</P> <P>You suggested using this app for Microsoft SQL server, but isnt that abandoned ? <BR /> It says on this page, <A href="https://splunkbase.splunk.com/app/1524/#/overview">https://splunkbase.splunk.com/app/1524/#/overview</A>.</P> Sun, 29 Oct 2017 23:09:18 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Will-the-Splunk-Add-on-for-Microsoft-SQL-Server-suffice-to/m-p/301509#M35980 damode 2017-10-29T23:09:18Z