All Apps and Add-ons

Splunk Add-On For MS SQL Server

hectorvp
Communicator

Hello Splunkers,

We need to fetch MS SQL logs into our Splunk.

We aren't allowed to use Splunk DB Connect for some security reasons.

Currently what we are deciding is to log all MS SQL audit events, trace events in Standard Windows Application events logs.

And fetch logs from  Windows Application Logs by UF.

Will this  "Splunk Add-On For MS SQL Server"  helpful for us in any way now? I guess this add on has dependency on "Splunk DB Connect".

I'm afraid with one more aspect that is  will all fields  of MS SQL  audit events be parsed????

 Please check this community link, regarding parsing issue

https://community.splunk.com/t5/Splunk-Enterprise-Security/Monitoring-MS-SQL-logs-from-Windows-Event... 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @hectorvp,

I didn't used this Add-on yes so I'm not sure about it.

Anyway, you could write SQL logs in a file using a store procedure and then read the file, then, after few minutes, delete the file.

Ciao.

Giuseppe

hectorvp
Communicator

Hi @gcusello , 

No worries, you always help us a lot.

Just one aspect with my above issue, if you can check the community link I'd pasted above they say there is some parsing field issue for forwarding these logs by the approach which we are looking forward.

Someone has mentioned about CIM data modelling, this is the new concept for me today.

As per my quick reading I found this is used to help Splunk to understand and identify logs with its fields.

But just this needs to know where this CIm modelling will be used ahead, I mean in UF or HF/indexer or both???

And how reliable it is ?? 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @hectorvp,

to better understand what's CIM read https://en.wikipedia.org/wiki/Common_Information_Model_(computing)

Anyway, CIM is relevat in parsing phase and this phase is done at HF/Indexers level.

Ciao.

Giuseppe

hectorvp
Communicator

Thanks a lot @gcusello 

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!