https://community.splunk.com/t5/Getting-Data-In/splunk-app-work-around-to-track-the-executed-SQL-server-queries/m-p/523249#M88377 <P>If you are not able to ingest data that already is produced that contains the query information, you could explore Splunk Stream to pull out the SQL query from the wire data. This could be quite the change so comparing it against enabling the trace log might be a good exercise. If the traffic is encrypted, the cert will be required to decrypt the traffic but you would be able to see the query, transaction times, etc.</P><P>&nbsp;</P><P>The following Splunk Lantern use case is very applicable to your question as well using Splunk Stream. <A href="https://lantern.splunk.com/hc/en-us/articles/360053617474-Analyzing-wire-data-from-databases" target="_blank">https://lantern.splunk.com/hc/en-us/articles/360053617474-Analyzing-wire-data-from-databases</A></P> Tue, 06 Oct 2020 18:01:07 GMT dmacintosh_splu 2020-10-06T18:01:07Z https://community.splunk.com/t5/Getting-Data-In/splunk-app-work-around-to-track-the-executed-SQL-server-queries/m-p/523247#M88376 <P>&nbsp;I want to track the executed SQL server queries, however I don't want to enable trace log because it would impact SQL server I/O and consume a lot of local space. So, I don't have any sql server trace logs (*.trc files) stored in the server/DB. Is there any work around or splunk app can track the executed SQL server queries?</P> Tue, 06 Oct 2020 17:47:34 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-app-work-around-to-track-the-executed-SQL-server-queries/m-p/523247#M88376 summer 2020-10-06T17:47:34Z https://community.splunk.com/t5/Getting-Data-In/splunk-app-work-around-to-track-the-executed-SQL-server-queries/m-p/523249#M88377 <P>If you are not able to ingest data that already is produced that contains the query information, you could explore Splunk Stream to pull out the SQL query from the wire data. This could be quite the change so comparing it against enabling the trace log might be a good exercise. If the traffic is encrypted, the cert will be required to decrypt the traffic but you would be able to see the query, transaction times, etc.</P><P>&nbsp;</P><P>The following Splunk Lantern use case is very applicable to your question as well using Splunk Stream. <A href="https://lantern.splunk.com/hc/en-us/articles/360053617474-Analyzing-wire-data-from-databases" target="_blank">https://lantern.splunk.com/hc/en-us/articles/360053617474-Analyzing-wire-data-from-databases</A></P> Tue, 06 Oct 2020 18:01:07 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-app-work-around-to-track-the-executed-SQL-server-queries/m-p/523249#M88377 dmacintosh_splu 2020-10-06T18:01:07Z https://community.splunk.com/t5/Getting-Data-In/splunk-app-work-around-to-track-the-executed-SQL-server-queries/m-p/523262#M88380 <P>Thanks for the quick response. it seems it requires some changes on&nbsp; sql server network setting?</P> Tue, 06 Oct 2020 18:49:56 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-app-work-around-to-track-the-executed-SQL-server-queries/m-p/523262#M88380 summer 2020-10-06T18:49:56Z