What is the best way to forward Guardium database data to Splunk?

[jorsy]

We are using Guardium to track all database activities of high-privileged database users.
All the data is stored in the Guardium database. We would like to forward all the Guardium data to Splunk (to be able to correlate with other data). What would be the best way to do this?

[matthew_ramsey]

If you've solved this issue please let me know as well.

[dshpritz]

The Guardium appliances have the ability to send syslog of their events:

From their docs: http://www-01.ibm.com/support/docview.wss?uid=swg21515374

[jorsy]

Thanks - we tested this and it works fine. We can send Guardium alerts to splunk using the template.
The problem is that in the Guardium message template you can only specify a limited set of fields (not all Guardium data can be sent using the message template).

[YoungDaniel]

Have you solved the issue, not being able to send all the data when using a template? Or how would you go about solving it?