Splunk doesn't really do database change monitoring directly, but there are a few ways to approach it.
Listed in order of preference:
- Configure MySQL to log all queries, then have Splunk index the log file, and monitor for DDL commands (`CREATE`, `UPDATE`, `ALTER`, etc.).
- Use a third-party database monitoring product that generates output in a text-based format that can be indexed by Splunk.
- Roll your own using scripted inputs. Either generate snapshots from the database containing the information you want to monitor and use `diff`, or watch for the changes yourself. This option will likely be painful.
If you are going to go with the first option, these may help get you started:
http://www.howtogeek.com/howto/database/monitor-all-sql-queries-in-mysql/
http://www.electrictoolbox.com/logging-queries-with-mysql/
http://dev.mysql.com/doc/refman/5.1/en/query-log.html
