https://community.splunk.com/t5/Splunk-Enterprise-Security/MS-SQL-logs-ingested-via-Windows-security-events-how-to-make-it/m-p/757443#M12812 <P>Hi All,</P><P>We have integrated MS SQL logs with Splunk. The current default add-on supports logs via DB Connect but we do not have database connectivity directly. Rather, all the logs are written in Security logs for Windows Event viewer with most of the details in the Message field.</P><P>Currently all the fields are not being parsed . How can we make it CIM compliant ?&nbsp;<BR /><BR /></P> Mon, 19 Jan 2026 14:18:33 GMT rahulhari88 2026-01-19T14:18:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/MS-SQL-logs-ingested-via-Windows-security-events-how-to-make-it/m-p/757443#M12812 <P>Hi All,</P><P>We have integrated MS SQL logs with Splunk. The current default add-on supports logs via DB Connect but we do not have database connectivity directly. Rather, all the logs are written in Security logs for Windows Event viewer with most of the details in the Message field.</P><P>Currently all the fields are not being parsed . How can we make it CIM compliant ?&nbsp;<BR /><BR /></P> Mon, 19 Jan 2026 14:18:33 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/MS-SQL-logs-ingested-via-Windows-security-events-how-to-make-it/m-p/757443#M12812 rahulhari88 2026-01-19T14:18:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/MS-SQL-logs-ingested-via-Windows-security-events-how-to-make-it/m-p/757446#M12813 <P>Since the data is not structured as expected by the "default add-on", you will have to craft your own add-on to parse the fields.</P> Mon, 19 Jan 2026 15:36:23 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/MS-SQL-logs-ingested-via-Windows-security-events-how-to-make-it/m-p/757446#M12813 richgalloway 2026-01-19T15:36:23Z