DB connect - Frequency settings

[SparklyBunny]

Hi, 

Could you help me understand what the frequency setting in Splunk DB Connect inputs refers to? If I set the frequency as "0 00-10 14-23 * * ", does this mean audit events will be batched and sent to Splunk every hour?

For the cron job that runs at 14:00, will it send records from 10:00 AM to 13:59 PM?

Based on this frequency, what timespan should I use in my search (e.g., _index_earliest=10m@m _index_latest=@m)?

Please advise. Thanks in advance. 

[SparklyBunny]

Hi,

Thanks for sharing the link. I want to pipe the DB logs to Splunk every hour except 11am to 1pm. Thereafter, i want to create a correlation rule in Splunk to flag out activities of interest. Am trying to understand if my logs are coming in hourly then can my timespan in my search be 10mins (e.g., _index_earliest=10m@m _index_latest=@m)? 

[isoutamo]

What is your problem which you are trying to solve? I mean real issue not how you are trying to solve it?

[SparklyBunny]

Hi @isoutamo , 

I'm currently reviewing the Splunk configuration for the DB and i noticed that the logs are forwarded to Splunk every hour except 11am to 1pm. So I'm wondering if the events between 10AM and 1:59PM, will it be forwarded to Splunk based on this configuration.

And also if the timespan set in the correlation rule is10mins (e.g., _index_earliest=10m@m _index_latest=@m), will I miss any records? 

[isoutamo]

What kind of SPL query you have in your db_input?
What is it's current schedule?
How you have verified that event's haven't have come to splunk?
Are you sure that there are events in DB for that time and also that those events are there on that time when you are quering those with DBX in 1st time?

[SparklyBunny]

My SPL query is as follows:

index=mssqlDB sourcetype=mssql* _index_earliest=10m@m _index_latest=@m

| stats count as events, dc(database_name) as databases, dc(login_name) as users, avg(duration) as avg_duration by host

my current schedule is 0 0-10,14-23 * * *

The other 2 questions are very good questions, but I have not thought of how to verify them yet. 

[isoutamo]

You have _index_earliest and _index_latest, but what are your earliest and latest.

Actually this is your search from splunk index, but what is your DB Connect input SQL statement?

[SparklyBunny]

My SQL statement is as follows:

select * FROM sys.fn_get_audit_file ('i:\sql\mssqlaudit*.sqlaudit', default, default)

WHERE event_time > ?

In addition, if the fetch size is set at 100, will affect the number of records that it will be pipe to Splunk? Thank you. 

[isoutamo]

Thanx. Can you copy that part from db_inputs.conf? Also add relevant part from inputs.conf, so we see the schedule also.

And put those inside </> editor tag, so this platform didn’t change your paste and it’s easier to read.

[SparklyBunny]

Hi,

Thanks for sharing the link. I want to pipe the DB logs to Splunk every hour except 11am to 1pm. Thereafter, i want to create a correlation rule in Splunk to flag out activities of interest. Am trying to understand if my logs are coming in hourly then can my timespan in my search be 10mins (e.g., _index_earliest=10m@m _index_latest=@m)? 

[livehybrid]

Hi @SparklyBunny 

This site is useful for understanding the cron frequency - https://crontab.guru/#0_00-10_14-23_*_*

At minute 0 past every hour from 0 through 10 on every day-of-month from 14 through 23.

The records that get pulled back and indexed in Splunk will really depend on what the DB query is and what data is returned, e.g is it pulling back from a specific time period or just number of events? 

What is it you're looking to achieve?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing