All Apps and Add-ons

How to configure input in DB Connect v3.1.2 for Splunk Add-on for Microsoft SQL Server using template mssql:audit ?

damode
Motivator

Hi I have been trying to set up the input on the DB Connect app "New Input" page using template mssql:audit template from the Splunk Add-on for Microsoft SQL Server add on but have not been able to progress much.

I am trying to figure out what would be the correct checkpoint value for the query below. I have tried lot of variations based on answers from other posts on this site, but none of the answers have proved useful in this case.

SELECT * 
FROM sys.fn_get_audit_file ('C:\\\\SQLAudit\\\\*',default,default) 
WHERE event_time > ?
ORDER BY event_time ASC

W.r.t Timestamp, I have chosen "event_time" as preferred column, and specified time format as yyyy-MM-dd HH:mm:ss.
Input type : Rising Column
Please help.

Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...