DBconnect Database name with date

[MaverickT]

I am trying to connect to Forefront Threat Management Gateway (ISA/TMG) SQL server database. I have succeeded to connect to database, but there is environment specific barrier that I came across. TMG is configured to create MSDB database for every single day and store logs in there. Is there any way to configure DBconnect to set database by date? Or is there some other workaround that can be used? Changes on TMG server are unfortunately not an option.

Last resort option is to run job every day that changes database.conf and reloads configuration, but I would like to solve it differently.

[HiroshiSatoh · Accepted solution]

Reboot is required When you change the Splunk.
You use the [Stored Procedure] by creating a database for the connection from the Splunk is but what?
The database name to connect to it converted by [Stored Procedure].

[MaverickT]

Thanks for the tip, I didn't came up with that workaround idea. I made stored procedure and now it works like a charm. I had slight problems how to use {{WHERE $rising_column$ > ?}} for that stored procedure, as there is no ID column, but I had later solved on MS SQL level, remembering the last time stored procedure was called.

[brewerv]

Aloha we would like to know more about the TMG server sql database and forwarding the logs to Splunk from the database.

[kiran331]

Hi MaverickT, Can you let me know the deatails for connecting to TMG server sql database?