All Apps and Add-ons

DBconnect Database name with date

MaverickT
Communicator

I am trying to connect to Forefront Threat Management Gateway (ISA/TMG) SQL server database. I have succeeded to connect to database, but there is environment specific barrier that I came across. TMG is configured to create MSDB database for every single day and store logs in there. Is there any way to configure DBconnect to set database by date? Or is there some other workaround that can be used? Changes on TMG server are unfortunately not an option.

Last resort option is to run job every day that changes database.conf and reloads configuration, but I would like to solve it differently.

0 Karma
1 Solution

HiroshiSatoh
Champion

Reboot is required When you change the Splunk.
You use the [Stored Procedure] by creating a database for the connection from the Splunk is but what?
The database name to connect to it converted by [Stored Procedure].

alt text

View solution in original post

HiroshiSatoh
Champion

Reboot is required When you change the Splunk.
You use the [Stored Procedure] by creating a database for the connection from the Splunk is but what?
The database name to connect to it converted by [Stored Procedure].

alt text

View solution in original post

MaverickT
Communicator

Thanks for the tip, I didn't came up with that workaround idea. I made stored procedure and now it works like a charm. I had slight problems how to use {{WHERE $rising_column$ > ?}} for that stored procedure, as there is no ID column, but I had later solved on MS SQL level, remembering the last time stored procedure was called.

0 Karma

brewerv
Engager

Aloha we would like to know more about the TMG server sql database and forwarding the logs to Splunk from the database.

0 Karma

kiran331
Builder

Hi MaverickT, Can you let me know the deatails for connecting to TMG server sql database?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!