https://community.splunk.com/t5/Monitoring-Splunk/What-are-the-Database-Monitoring-features-available-in-Splunk/m-p/227538#M6670 <P>The <A href="https://splunkbase.splunk.com/app/2686/">DB Connect app</A> allows Splunk to read, index or otherwise use actual Database tables, views and queries directly. So for instance if you had your asset list inside some other system that had a DB you could get to, you could use Splunk to read that table into itself for use there, or use it directly as a lookup from Splunk.</P> <P>Using a forwarding on the DB host gets you their logs, events, and occasionally other information - mostly from the OS level although that's a little blurred because many DB logs are also os-level logs. But it doesn't really allow you to read <EM>data</EM> from the databases. (Unless you have a job in your DBMS that runs and dumps information into a file on a schedule, you could then use the UF to read that and send it to the indexers).</P> <P>The various apps and add ons (like this one for <A href="https://splunkbase.splunk.com/app/2648/">SQL Server</A>) is where you get the DB logs that aren't "OS-level" as I mention above, and which allow you to do magical things with the management layer of SQL - collecting audit trails <EM>from SQL</EM>, or detailed performance information <EM>for SQL</EM>. </P> <P>Does that help?</P> Sun, 02 Oct 2016 12:32:59 GMT Richfez 2016-10-02T12:32:59Z https://community.splunk.com/t5/Monitoring-Splunk/What-are-the-Database-Monitoring-features-available-in-Splunk/m-p/227537#M6669 <P>Hello</P> <P>Good Day !</P> <P>We have recently installed splunk and we are monitoring the DB related health after installing Forwarder in DB Servers<BR /> Can you please let me know if there are additional features that are available if we use database connect, if yes please let me know if there is any documentation I can refer</P> <P>If there already a pre-built app that I can refer kindly let me know the details for them also</P> <P>thank you for helping</P> <P>thanks<BR /> aparna</P> Sun, 02 Oct 2016 08:33:49 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-are-the-Database-Monitoring-features-available-in-Splunk/m-p/227537#M6669 aparnaa 2016-10-02T08:33:49Z https://community.splunk.com/t5/Monitoring-Splunk/What-are-the-Database-Monitoring-features-available-in-Splunk/m-p/227538#M6670 <P>The <A href="https://splunkbase.splunk.com/app/2686/">DB Connect app</A> allows Splunk to read, index or otherwise use actual Database tables, views and queries directly. So for instance if you had your asset list inside some other system that had a DB you could get to, you could use Splunk to read that table into itself for use there, or use it directly as a lookup from Splunk.</P> <P>Using a forwarding on the DB host gets you their logs, events, and occasionally other information - mostly from the OS level although that's a little blurred because many DB logs are also os-level logs. But it doesn't really allow you to read <EM>data</EM> from the databases. (Unless you have a job in your DBMS that runs and dumps information into a file on a schedule, you could then use the UF to read that and send it to the indexers).</P> <P>The various apps and add ons (like this one for <A href="https://splunkbase.splunk.com/app/2648/">SQL Server</A>) is where you get the DB logs that aren't "OS-level" as I mention above, and which allow you to do magical things with the management layer of SQL - collecting audit trails <EM>from SQL</EM>, or detailed performance information <EM>for SQL</EM>. </P> <P>Does that help?</P> Sun, 02 Oct 2016 12:32:59 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-are-the-Database-Monitoring-features-available-in-Splunk/m-p/227538#M6670 Richfez 2016-10-02T12:32:59Z