Splunk Dev

Can Splunk read data from Aud$ and FGA_LOG$ ,can it be used to replace Oracle Audit vault

pradeep2210
New Member

looking for the these information to pull live data from oracle database. Can it also pull the data from xml file.
any limit on the data length and character

Tags (1)
0 Karma

pmdba
Builder

This will depend somewhat on what version of Oracle you are running. Oracle 11g can write audit records to text or xml files or syslog, or keep them in the database where you can index them using Splunk DBConnect. Starting with Oracle 12c, audit records are only stored in a new unified audit trail table and no longer written to external files, so DBConnect will be your only option. In general Splunk doesn't have any limit on the amount or size of data ingested. If you can read the file or run the SQL query Splunk can index the results.

That said, if you have any concerns about bumping into your Splunk license limit, I would advise reading audit records from syslog or Oracle's .aud text files and avoiding XML. The XML tags make it easy for Splunk to identify fields, but will consume twice as much of your license pulling in those extra characters. If you are running SQL queries, consider which columns from the audit tables you want to include; you can save overhead on your license if you can exclude some of them.

It's a little dated (DB Connect is on version 3.0 now), but the following add-on can explain the basics of pulling in data from a variety of Oracle related sources. Log File Analysis for Oracle 11g.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...