All Apps and Add-ons

How to configure input in DB Connect v3.1.2 for Splunk Add-on for Microsoft SQL Server using template mssql:audit ?

damode
Motivator

Hi I have been trying to set up the input on the DB Connect app "New Input" page using template mssql:audit template from the Splunk Add-on for Microsoft SQL Server add on but have not been able to progress much.

I am trying to figure out what would be the correct checkpoint value for the query below. I have tried lot of variations based on answers from other posts on this site, but none of the answers have proved useful in this case.

SELECT * 
FROM sys.fn_get_audit_file ('C:\\\\SQLAudit\\\\*',default,default) 
WHERE event_time > ?
ORDER BY event_time ASC

W.r.t Timestamp, I have chosen "event_time" as preferred column, and specified time format as yyyy-MM-dd HH:mm:ss.
Input type : Rising Column
Please help.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!