All Apps and Add-ons

Reading MSSQL logs into splunk

rgtsplunk
Explorer

We are trying to read log files from Microsoft SQL servers. We have installed forwarders on the servers to send data to our indexers. The data is getting through to our indexers, but nothing is going into splunk. It appears that the mssql log files are binary files, so splunk will not index them. How can we get them into text and into splunk for searching?

ahall_splunk
Splunk Employee
Splunk Employee

Which specific log files are you trying to read?

The MSSQL "transaction log" files are binary and are not splunkable. If you are after audit logs, then this needs to be configured within the MSSQL Management Console - at which point you choose the file location or Windows Event Log streams.

You can use the Splunk App for Microsoft SQL Server - it contains a specific TA for doing the SQL Server logs (both audit and functional aspects).

0 Karma

rgtsplunk
Explorer

I did download and install the Splunk App for Microsoft SQL Server, but did not see anything in the TA that would read the log files.

It also said that this app requires Splunk add-on for Microsoft Windows and Splunk add-on for Microsoft Powershell. We do not need the Microsoft Windows events, as they are being read by a different method already, and I do not know what Microsoft Powershell does.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Thats because the system log files and the audit logs files (if you follow the instructions) are provided within the Windows Event Logs - the TA and app contain specific decodes for those logs so you can recognize them.

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...