topic Can we use DB connect to send Azure Database Logs to Splunk? in Getting Data In

Can we use DB connect to send Azure Database Logs to Splunk?

umesh — Mon, 26 Jun 2023 15:11:57 GMT

Hi Team,

I wanted to check my SQL database server is hosted on azure. Is there a way to onboard logs to splunk.

Can we use DB connect app for Servers hosted on azure. Will it work.

Please let me know if there is any other alternative solution for this .

umesh — Mon, 26 Jun 2023 11:09:39 GMT

@gcusello can you please help on the above requirement

gcusello — Mon, 26 Jun 2023 12:16:00 GMT

you have two solutions:

use DB-Connect App to run SQL queries,
schedule a store procedure that saves results in a file and use a Universal Forwarder to read these files and send them to Splunk.

Ciao.

Giuseppe

VatsalJagani — Tue, 27 Jun 2023 05:50:36 GMT

@umesh - Adding to @gcusello 's 1st point on the collect via DB Connect, you have two options:

Install Splunk HF and DB Connect App locally on Azure VM
- You don't have to expose the database outside of Azure
- You will have the overhead of Splunk locally on Azure VM
- Enable Splunk to Splunk SSL connectivity on data port (generally 9997) to ensure security
Install Splunk HF on a separate machine on-prem or Azure and install DB Connect App there
- You have to expose the database port for external connection
- You don't have to install anything on the database server
- Enable DB Connect to database connection only on SSL to ensure security

Both have tradeoffs, and can be used based on your environment's requirement.

I hope this helps!!!