Can we use DB connect to send Azure Database Logs to Splunk?

[umesh]

Hi Team,

I wanted to check my SQL database server is hosted on azure. Is there a way to onboard logs to splunk.

Can we use DB connect app for Servers hosted on azure. Will it work.

Please let me know if there is any other alternative solution for this .

[umesh]

@gcusello  can you please help on the above requirement

[gcusello]

Hi @umesh ,

you have two solutions:

• use DB-Connect App to run SQL queries,
• schedule a store procedure that saves results in a file and use a Universal Forwarder to read these files and send them to Splunk.

Ciao.

Giuseppe

[VatsalJagani · Accepted solution]

@umesh - Adding to @gcusello 's 1st point on the collect via DB Connect, you have two options:

• Install Splunk HF and DB Connect App locally on Azure VM
  • You don't have to expose the database outside of Azure
  • You will have the overhead of Splunk locally on Azure VM
  • Enable Splunk to Splunk SSL connectivity on data port (generally 9997) to ensure security
• Install Splunk HF on a separate machine on-prem or Azure and install DB Connect App there
  
  • You have to expose the database port for external connection
  • You don't have to install anything on the database server
  • Enable DB Connect to database connection only on SSL to ensure security

Both have tradeoffs, and can be used based on your environment's requirement.

I hope this helps!!!