Getting Data In

splunk app/work around to track the executed SQL server queries

summer
Observer

 I want to track the executed SQL server queries, however I don't want to enable trace log because it would impact SQL server I/O and consume a lot of local space. So, I don't have any sql server trace logs (*.trc files) stored in the server/DB. Is there any work around or splunk app can track the executed SQL server queries?

Labels (1)
0 Karma

dmacintosh_splu
Splunk Employee
Splunk Employee

If you are not able to ingest data that already is produced that contains the query information, you could explore Splunk Stream to pull out the SQL query from the wire data. This could be quite the change so comparing it against enabling the trace log might be a good exercise. If the traffic is encrypted, the cert will be required to decrypt the traffic but you would be able to see the query, transaction times, etc.

 

The following Splunk Lantern use case is very applicable to your question as well using Splunk Stream. https://lantern.splunk.com/hc/en-us/articles/360053617474-Analyzing-wire-data-from-databases

0 Karma

summer
Observer

Thanks for the quick response. it seems it requires some changes on  sql server network setting?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...