MS SQL logs ingested via Windows security events ,...

rahulhari88 · ‎01-19-2026

Hi All,

We have integrated MS SQL logs with Splunk. The current default add-on supports logs via DB Connect but we do not have database connectivity directly. Rather, all the logs are written in Security logs for Windows Event viewer with most of the details in the Message field.

Currently all the fields are not being parsed . How can we make it CIM compliant ?

richgalloway · ‎01-19-2026

Since the data is not structured as expected by the "default add-on", you will have to craft your own add-on to parse the fields.

---
If this reply helps you, Karma would be appreciated.

MS SQL logs ingested via Windows security events , how to make it CIM compliant ?

using Enterprise Security

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation