Windows SQL database

[abdullahalhabba]

Hi Splunker;

I have connected with SQL databases, and admin SQL created a database-level audit object for enable the audit logs and we used the user which exist on AD means we used windows authentication when connect with SQL database but when admin SQL grant this splunk user read only appear error on splunk this error is (failed login) but when change permission from "read only" to "CONTROL SERVER" Splunk connected with database and pulled audit logs, the following is the query executed:

SELECT * FROM sys.fn_get_audit_file ('D:\\SQLAudit\\*',default,default) WHERE event_time > ? ORDER BY event_time ASC

Why when grant splunk user read only appear failed login? but when grant it "CONTROL SERVER" full privilege connect with database

We have splunk 6.6.5 and DB app 3.1.3

Please we need your support in that

Regards;

[guarisma]

To access sys.fn_get_audit_file you need, at least, CONTROL SERVER role