SQLAUDIT logs files from folder

[AbelCruz]

Hello

We have several DB servers that are sending logs to a single folder.
How can I collect those logs into Splunk?
Do I need to create a new sourcetype or can they be indexed into an app?

Thank you in advance

[gcusello]

Hi AbelCruz,
if your DB Servers send logs to a folder, you can install a Universal Forwarder and read these files for indexing.

About the sourcetype, if your logs are from SQL-Server or Oracle or a main db probably you can find a sourcetype in Splunk baseline, otherwise you can create a new one using the web guided procedure.

Bye.
Giuseppe