Getting Data In

Can we use DB connect to send Azure Database Logs to Splunk?

umesh
Path Finder

Hi Team,

 

I wanted to check my SQL database server is hosted on azure. Is there a way to onboard logs to splunk.

Can we use DB connect app for Servers hosted on azure. Will it work.

 

Please let me know if there is any other alternative solution for this .

Tags (3)
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

@umesh - Adding to @gcusello 's 1st point on the collect via DB Connect, you have two options:

  • Install Splunk HF and DB Connect App locally on Azure VM
    • You don't have to expose the database outside of Azure
    • You will have the overhead of Splunk locally on Azure VM
    • Enable Splunk to Splunk SSL connectivity on data port (generally 9997) to ensure security
  • Install Splunk HF on a separate machine on-prem or Azure and install DB Connect App there
    • You have to expose the database port for external connection
    • You don't have to install anything on the database server
    • Enable DB Connect to database connection only on SSL to ensure security

 

Both have tradeoffs, and can be used based on your environment's requirement.

 

I hope this helps!!!

View solution in original post

umesh
Path Finder

@gcusello  can you please help on the above requirement

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @umesh ,

you have two solutions:

  • use DB-Connect App to run SQL queries,
  • schedule a store procedure that saves results in a file and use a Universal Forwarder to read these files and send them to Splunk.

Ciao.

Giuseppe

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@umesh - Adding to @gcusello 's 1st point on the collect via DB Connect, you have two options:

  • Install Splunk HF and DB Connect App locally on Azure VM
    • You don't have to expose the database outside of Azure
    • You will have the overhead of Splunk locally on Azure VM
    • Enable Splunk to Splunk SSL connectivity on data port (generally 9997) to ensure security
  • Install Splunk HF on a separate machine on-prem or Azure and install DB Connect App there
    • You have to expose the database port for external connection
    • You don't have to install anything on the database server
    • Enable DB Connect to database connection only on SSL to ensure security

 

Both have tradeoffs, and can be used based on your environment's requirement.

 

I hope this helps!!!

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...