All Apps and Add-ons

Reading MSSQL logs into splunk

rgtsplunk
Explorer

We are trying to read log files from Microsoft SQL servers. We have installed forwarders on the servers to send data to our indexers. The data is getting through to our indexers, but nothing is going into splunk. It appears that the mssql log files are binary files, so splunk will not index them. How can we get them into text and into splunk for searching?

ahall_splunk
Splunk Employee
Splunk Employee

Which specific log files are you trying to read?

The MSSQL "transaction log" files are binary and are not splunkable. If you are after audit logs, then this needs to be configured within the MSSQL Management Console - at which point you choose the file location or Windows Event Log streams.

You can use the Splunk App for Microsoft SQL Server - it contains a specific TA for doing the SQL Server logs (both audit and functional aspects).

0 Karma

rgtsplunk
Explorer

I did download and install the Splunk App for Microsoft SQL Server, but did not see anything in the TA that would read the log files.

It also said that this app requires Splunk add-on for Microsoft Windows and Splunk add-on for Microsoft Powershell. We do not need the Microsoft Windows events, as they are being read by a different method already, and I do not know what Microsoft Powershell does.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Thats because the system log files and the audit logs files (if you follow the instructions) are provided within the Windows Event Logs - the TA and app contain specific decodes for those logs so you can recognize them.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...