https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109715#M230 <P>Thank you for your answer,</P> <P>But it's not about getting sqlserver logs into Splunk Enterprise, it's about loading it into the Splunk App for Enterprise Security 3.0.1. <BR /> So i'm looking for an add-on "Security and Compliance" that i can use with ES.</P> <P>Have you any idea ?</P> Fri, 23 Jan 2015 11:38:59 GMT MinaMina 2015-01-23T11:38:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109713#M228 <P>Hello,</P> <P>I need to put sql server logs into Splunk for Enterprise Security. Is there any add-on available? I found an Add-on for Oracle, but not for Sqlserver.</P> <P>Thx in advance</P> Thu, 22 Jan 2015 22:10:15 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109713#M228 MinaMina 2015-01-22T22:10:15Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109714#M229 <P>I haven't used SQLServer in a long time, but as I recall a lot of what it records goes into the Windows system logs. The <A href="https://apps.splunk.com/app/1680/">Splunk App for Windows Infrastructure</A> or the Universal Forwarder should be able to pick up those records. For anything getting written to an actual log file it should just be a matter of creating a custom file input and directing the data to an index, as described <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/UseSplunkWeb">here</A>.</P> Thu, 22 Jan 2015 23:22:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109714#M229 pmdba 2015-01-22T23:22:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109715#M230 <P>Thank you for your answer,</P> <P>But it's not about getting sqlserver logs into Splunk Enterprise, it's about loading it into the Splunk App for Enterprise Security 3.0.1. <BR /> So i'm looking for an add-on "Security and Compliance" that i can use with ES.</P> <P>Have you any idea ?</P> Fri, 23 Jan 2015 11:38:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109715#M230 MinaMina 2015-01-23T11:38:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109716#M231 <P>Do you have your logs already in Splunk? I'm trying to figure out if the issue is getting the logs themselves in Splunk or getting them tagged and extracted such that they work with ES. I'm just trying to understand so that the I provide the right guidance.</P> Thu, 29 Jan 2015 21:28:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109716#M231 LukeMurphey 2015-01-29T21:28:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109717#M232 <P>Not yet, i'm in a planification step. yes, it's about the second one (getting them tagged and extracted such that they work with ES) <BR /> I found this one <A href="https://apps.splunk.com/app/742/">https://apps.splunk.com/app/742/</A><BR /> I'm not sure it will work because it wasn't developped for a use with ES.</P> Sun, 01 Feb 2015 11:06:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109717#M232 MinaMina 2015-02-01T11:06:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109718#M233 <P>Hi MinaMina,</P> <P>Thanks for your question. We just published a Splunk Add-on for Microsoft SQL Server: <A href="https://apps.splunk.com/app/2648/">https://apps.splunk.com/app/2648/</A>. I hope this helps. </P> Thu, 26 Feb 2015 16:36:57 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109718#M233 rpille_splunk 2015-02-26T16:36:57Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109719#M234 <P>@rpille the addon "Splunk Add-on for Microsoft SQL Server" collects basic data about performance of SQL server </P> <P>what i am interested to look at is - <BR /> - who has accessed the database recently <BR /> - what change has been made on the database recently <BR /> - which new user has been created on the DB recently <BR /> - etc...</P> <P>could u plz suggest what has to be done for to get this logs. </P> <P>i saw SQL management suite has some logs there, how can we get that forwarded to SPlunk ?</P> Mon, 24 Oct 2016 08:43:08 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109719#M234 saurabh_tek 2016-10-24T08:43:08Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109720#M235 <P>@saurabh_tek r u able to find the solution ?</P> Tue, 13 Nov 2018 04:29:47 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/109720#M235 sumitkathpal292 2018-11-13T04:29:47Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/509525#M9016 <P>Did you find a way how to do it please?</P> Thu, 16 Jul 2020 13:49:57 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/509525#M9016 saraelamr 2020-07-16T13:49:57Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/612107#M11017 <P>i wanted to get below logs from sql server.<BR /><BR /><SPAN>who has accessed the database recently</SPAN><BR /><SPAN>- what change has been made on the database recently</SPAN><BR /><SPAN>- which new user has been created on the DB recently</SPAN></P><P>&nbsp;</P><P><SPAN>Splunk Add-on for Microsoft SQL Server : do not give above logs. Please suggest</SPAN></P> Tue, 06 Sep 2022 13:55:50 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-SQL-server-logs-into-Splunk-for-Enterprise-Security/m-p/612107#M11017 sonishar 2022-09-06T13:55:50Z