Does the Splunk Add-on for Microsoft SQL Server only work with Enterprise versions, or can we use it with the Standard/Express edition?

[charliel]

Looking at the documentation for the Splunk Add-on for Microsoft SQL Server, it specifies that the versions of SQL supported are Enterprise...
http://docs.splunk.com/Documentation/AddOns/latest/MSSQLServer/About
does this not work on Standard/Express edition? Or can it be installed, but would just be missing some functionality?

[Richfez]

It is possible that it only supports certain versions.

In SQL 2005 and SQL 2008 the audit stuff was only in SQL Enterprise. In 2012 MS moved the server audit stuff into SQL Standard, but left the DB audit stuff in Enterprise.

Server audit stuff is like log on, log off, backups - service manipulation and auditing.

Database audit on the other hand can be enabled on individual rows and other data itself.

It could possibly be that it used to require Enterprise, but SQL 2012 and up it'll work OK on Standard and they've just forgotten to update the docs. There's not much harm in trying it in either case.

[Richfez]

A good page on the differences in auditing in different versions of SQL can be found here.

[charliel]

Hi @ppablo_splunk,

Yes, that is the add-on I'm talking about...looking at this link, for Vendor Products it specifically mentions Enterprise on the SQL Versions:

http://docs.splunk.com/Documentation/AddOns/latest/MSSQLServer/About

Thanks,

Charlie

[ppablo]

Hi @charliel

What add-on specifically from Splunkbase are you referring to when you say "SQL Add-on"?

Are you talking about the Splunk Add-on for Microsoft SQL Server?
https://splunkbase.splunk.com/app/2648/