Integrate MSSQL standard edition with Splunk

[Nawab]

We need to integrate MSSQL standard edition with splunk, so we tried sending logs to Windows Event Viewer application channel. Now we are getting logs, but the issue is logs are not parsed and we are getting all logs.

My question is if someone has integrated MSSQL standard edition with splunk. how you did it and is data parsed

[Nawab]

No i didnt because there is no sourcetype or input if logs are coming in application channel

[gcusello]

Hi @Nawab ,

you should use the sourcetypes used in the add-on.

Add-on should be installed in the Forwarder used to ingest data and on the Search Heads, used for search tipe parsing activities.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[PickleRick]

Well, the Add-On for MSSQL is the supported way of getting audit data from MSSQL databases. If you want to do it another way, you're pretty much on your own.

[gcusello · Accepted solution]

Hi @Nawab ,

did you installed the SQL-Server Add-On https://splunkbase.splunk.com/app/2648 on the Search Heads and on the Indexers or (if present) on the Heavy Forwarders?

Ciao.

Giuseppe

[PickleRick]

The MSSQL Add-On has installation and configuration docs. Did you read them?

https://docs.splunk.com/Documentation/AddOns/released/MSSQLServer/About