Reading MSSQL logs into splunk

[rgtsplunk]

We are trying to read log files from Microsoft SQL servers. We have installed forwarders on the servers to send data to our indexers. The data is getting through to our indexers, but nothing is going into splunk. It appears that the mssql log files are binary files, so splunk will not index them. How can we get them into text and into splunk for searching?

[ahall_splunk]

Which specific log files are you trying to read?

The MSSQL "transaction log" files are binary and are not splunkable. If you are after audit logs, then this needs to be configured within the MSSQL Management Console - at which point you choose the file location or Windows Event Log streams.

You can use the Splunk App for Microsoft SQL Server - it contains a specific TA for doing the SQL Server logs (both audit and functional aspects).

[rgtsplunk]

I did download and install the Splunk App for Microsoft SQL Server, but did not see anything in the TA that would read the log files.

It also said that this app requires Splunk add-on for Microsoft Windows and Splunk add-on for Microsoft Powershell. We do not need the Microsoft Windows events, as they are being read by a different method already, and I do not know what Microsoft Powershell does.

[ahall_splunk]

Thats because the system log files and the audit logs files (if you follow the instructions) are provided within the Windows Event Logs - the TA and app contain specific decodes for those logs so you can recognize them.