MSSQL ERRORLOG problem

[daniellim]

I am using splunk to monitor the MSSQL ERRORLOG files.

My goal is to list the failed and success logons into MSSQL. Without using db connect 2 and just the Splunk_TA_microsoft-sqlserver, am I looking into the correct logs (ERRORLOG*) for this??

inputs.conf
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL12\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog
disabled = 0

The file path is correct, however, i realized there wasn't a stanza in the props.conf for [mssql:errorlog]

My question is am i looking at the correct log file, and do I have to do a manual field extraction for this sourcetype [mssql:errorlog] for MSSQL failed and success logons?

[Azeemering]

Yes you are correct. The mssql errorlog cycles from ERRORLOG1 till 99

Make sure you also set your CHARSET correct as you might get weird results otherwise.
Something like this:
[mssql:errorlog]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
MAX_TIMESTAMP_LOOKAHEAD=22
disabled=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%2N
TIME_PREFIX=^
HEADER_FIELD_LINE_NUMBER=8
LINE_BREAKER=([\r\n]+)\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{2}
TRUNCATE=999999

And yes this will probably mean manual field extraction. I think we are a few months further. I'd like to know how you got on with this?