topic Re: Any suggestions for Splunking SAS logs? in Getting Data In

Any suggestions for Splunking SAS logs?

jimodonald — Fri, 21 Oct 2016 18:35:15 GMT

I'm being asked to ingest the SAS job logs into Splunk. So I thought I'd ask out here if anyone has already done this?

TIA,
Jim

Re: Any suggestions for Splunking SAS logs?

patrickalbers72 — Tue, 21 Nov 2017 14:37:04 GMT

Hi,
Are you any further with ingesting (by the forwarder) and tieing together fields of different SAS log jobs ? allready experience with SAS and DB Connect ?

Re: Any suggestions for Splunking SAS logs?

afamoyib — Tue, 21 Nov 2017 21:56:02 GMT

i used custom scripts to populate my sas logs. You can track stuff like disk usuage by users on the SAS work or SAS data spaces. I use it for admin tasks such as cert expiration, start up of sas, shutdown of sas. From an admin point of view that was how far i was able to go with it. With VA available not sure how much deeper i can suggest.

Re: Any suggestions for Splunking SAS logs?

patrickalbers72 — Wed, 22 Nov 2017 08:57:25 GMT

Very interesting ! My college from SOC send me soon queries about user activity , such as suspicious querying by users. Do you have some custom script examples for analysing availability and security such as disk usage ? We also going to use Teradata DBQL/PDCR logs and Linux nmon logs, but that's not available yet..

Re: Any suggestions for Splunking SAS logs?

wcampos — Wed, 28 Apr 2021 11:46:19 GMT

Hello.

I know its an old topic but did you get it to work? I'm doing it right now, the basic stuff untill now, like Logins, libname mapping, sas compress effect, sas procs used, errors...