https://community.splunk.com/t5/Getting-Data-In/Parsing-SQL-Queries/m-p/406740#M72159 <P>I am analyzing SQL Queries executed by users, is there any way to parse this queries. e.g. In insert query every time schema and values will be dynamic.</P> <P>Sample event : </P> <BLOCKQUOTE> <P>insert into UtilityConnectivityHandler(ErrorCode,InstanceName,MailHost,MailBox,IssueDesc,IssueDateTime)VALUES ('A','B','C','D,E,F,G','H ',GETDATE())</P> </BLOCKQUOTE> Mon, 13 Aug 2018 09:36:01 GMT masterpiece 2018-08-13T09:36:01Z https://community.splunk.com/t5/Getting-Data-In/Parsing-SQL-Queries/m-p/406740#M72159 <P>I am analyzing SQL Queries executed by users, is there any way to parse this queries. e.g. In insert query every time schema and values will be dynamic.</P> <P>Sample event : </P> <BLOCKQUOTE> <P>insert into UtilityConnectivityHandler(ErrorCode,InstanceName,MailHost,MailBox,IssueDesc,IssueDateTime)VALUES ('A','B','C','D,E,F,G','H ',GETDATE())</P> </BLOCKQUOTE> Mon, 13 Aug 2018 09:36:01 GMT https://community.splunk.com/t5/Getting-Data-In/Parsing-SQL-Queries/m-p/406740#M72159 masterpiece 2018-08-13T09:36:01Z https://community.splunk.com/t5/Getting-Data-In/Parsing-SQL-Queries/m-p/406741#M72160 <P>What are you wanting to retrieve from the events?</P> Mon, 13 Aug 2018 10:40:09 GMT https://community.splunk.com/t5/Getting-Data-In/Parsing-SQL-Queries/m-p/406741#M72160 richgalloway 2018-08-13T10:40:09Z