MS SQL logs ingested via Windows security events ,...

rahulhari88 · ‎01-19-2026

Hi All,

We have integrated MS SQL logs with Splunk. The current default add-on supports logs via DB Connect but we do not have database connectivity directly. Rather, all the logs are written in Security logs for Windows Event viewer with most of the details in the Message field.

Currently all the fields are not being parsed . How can we make it CIM compliant ?

richgalloway · ‎01-19-2026

Since the data is not structured as expected by the "default add-on", you will have to craft your own add-on to parse the fields.

---
If this reply helps you, Karma would be appreciated.

MS SQL logs ingested via Windows security events , how to make it CIM compliant ?

using Enterprise Security

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation