topic Re: SPLUNK SQL AUDIT in Splunk Enterprise

SPLUNK SQL AUDIT

edgarsilva01 — Fri, 10 Jul 2020 19:19:26 GMT

Hello

I have a problem with some .sqlaudit files

These files are being stored in the following path Z: \ audit \
Install a forwarder but Splunk doesn't seem to recognize these files.

Use the Splunk app add-on for SQL Servers, and only be logs of Performance.

Does anyone know how I can get the .sqludit files?

Re: SPLUNK SQL AUDIT

richgalloway — Fri, 10 Jul 2020 20:13:31 GMT

sqlaudit files are not text so they will not be indexed by Splunk. You will need to use a third-party tool to export the sqlaudit file to a text file that can be indexed.

Re: SPLUNK SQL AUDIT

isoutamo — Fri, 10 Jul 2020 20:21:06 GMT

this https://docs.splunk.com/Documentation/AddOns/released/MSSQLServer/SQLServerconfiguration should help you.

r. Ismo

Re: SPLUNK SQL AUDIT

edgarsilva01 — Fri, 10 Jul 2020 22:24:16 GMT

Hi Richgalloway

What process do you recommend?

Regards

Re: SPLUNK SQL AUDIT

edgarsilva01 — Fri, 10 Jul 2020 22:27:14 GMT

Hi Soutamo,

The link process is already done, however the output of the files is .sqlaudit and in the same way Splunk does not index them 😞

Re: SPLUNK SQL AUDIT

isoutamo — Sat, 11 Jul 2020 19:06:37 GMT

does this https://stackoverflow.com/questions/48345774/output-sqlaudit-file-results-to-text-file-tsql help you? Unfortunately I haven’t any ms sql where to test this.

r. Ismo

Re: SPLUNK SQL AUDIT

kamila44cw — Fri, 10 Sep 2021 01:14:38 GMT

Hi edgarsilva01,

Di you manage to find a solution for this. I am having the same problem. My environment was already setup by someone else, and when I do a search with index=sql I get 10 source which include the ERRORLOG files in MSSQL\Log\ folder and another source called "Index SQL CDS Server Audit", not sure where this source is coming from.

I cannot see any logs originating from the .sqlaudit file

Kind Regards..