Hi I have been trying to set up the input on the DB Connect app "New Input" page using template mssql:audit template from the Splunk Add-on for Microsoft SQL Server add on but have not been able to progress much.
I am trying to figure out what would be the correct checkpoint value for the query below. I have tried lot of variations based on answers from other posts on this site, but none of the answers have proved useful in this case.
SELECT *
FROM sys.fn_get_audit_file ('C:\\\\SQLAudit\\\\*',default,default)
WHERE event_time > ?
ORDER BY event_time ASC
W.r.t Timestamp, I have chosen "event_time" as preferred column, and specified time format as yyyy-MM-dd HH:mm:ss.
Input type : Rising Column
Please help.
