https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-a-Query-in-Splunk-to-monitor-Oracle-database/m-p/351018#M64409 <P>Logs have already been forwarded to syslog.</P> <P>I started with this query: </P> <PRE><CODE>index=syslog sourcetype=syslog (host="masked for security") NOT "CLIENT TERMINAL:[0]" "DBID" "SYSDBA" </CODE></PRE> <P>which returned the following event:</P> <PRE><CODE>&lt;140&gt;Apr 18 14:42:23 (host name masked for security) Audit[41355908]: LENGTH : '158' ACTION :[6] 'COMMIT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/6' STATUS:[1] '0' DBID:[10] '3032765733' </CODE></PRE> <P>Is there a way to run a correlation search to match the username to the DATABASE USER?</P> Fri, 20 Apr 2018 05:50:34 GMT jmyrand 2018-04-20T05:50:34Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-a-Query-in-Splunk-to-monitor-Oracle-database/m-p/351018#M64409 <P>Logs have already been forwarded to syslog.</P> <P>I started with this query: </P> <PRE><CODE>index=syslog sourcetype=syslog (host="masked for security") NOT "CLIENT TERMINAL:[0]" "DBID" "SYSDBA" </CODE></PRE> <P>which returned the following event:</P> <PRE><CODE>&lt;140&gt;Apr 18 14:42:23 (host name masked for security) Audit[41355908]: LENGTH : '158' ACTION :[6] 'COMMIT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/6' STATUS:[1] '0' DBID:[10] '3032765733' </CODE></PRE> <P>Is there a way to run a correlation search to match the username to the DATABASE USER?</P> Fri, 20 Apr 2018 05:50:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-a-Query-in-Splunk-to-monitor-Oracle-database/m-p/351018#M64409 jmyrand 2018-04-20T05:50:34Z