Splunk Add-On For MS SQL Server

[hectorvp]

Hello Splunkers,

We need to fetch MS SQL logs into our Splunk.

We aren't allowed to use Splunk DB Connect for some security reasons.

Currently what we are deciding is to log all MS SQL audit events, trace events in Standard Windows Application events logs.

And fetch logs from  Windows Application Logs by UF.

Will this  "Splunk Add-On For MS SQL Server"  helpful for us in any way now? I guess this add on has dependency on "Splunk DB Connect".

I'm afraid with one more aspect that is  will all fields  of MS SQL  audit events be parsed????

 Please check this community link, regarding parsing issue

https://community.splunk.com/t5/Splunk-Enterprise-Security/Monitoring-MS-SQL-logs-from-Windows-Event... 

[gcusello]

Hi @hectorvp,

I didn't used this Add-on yes so I'm not sure about it.

Anyway, you could write SQL logs in a file using a store procedure and then read the file, then, after few minutes, delete the file.

Ciao.

Giuseppe

[hectorvp]

Hi @gcusello , 

No worries, you always help us a lot.

Just one aspect with my above issue, if you can check the community link I'd pasted above they say there is some parsing field issue for forwarding these logs by the approach which we are looking forward.

Someone has mentioned about CIM data modelling, this is the new concept for me today.

As per my quick reading I found this is used to help Splunk to understand and identify logs with its fields.

But just this needs to know where this CIm modelling will be used ahead, I mean in UF or HF/indexer or both???

And how reliable it is ?? 

[gcusello]

Hi @hectorvp,

to better understand what's CIM read https://en.wikipedia.org/wiki/Common_Information_Model_(computing)

Anyway, CIM is relevat in parsing phase and this phase is done at HF/Indexers level.

Ciao.

Giuseppe

[hectorvp]

Thanks a lot @gcusello