According to
https://docs.splunk.com/Documentation/AddOns/released/MSSQLServer/SQLServerconfiguration
Audit events get written into a binary file C:\SQLAudit which then gets read via a DB connect query.
This is problematic when we need to monitor hundreds of different MSSQL Server DBs and would imply us setting up several HFs just for this tech stack alone (as well as very infrequent ingestion queries which doesn't seem a great fit for ES)
Even though writing audit events via Windows Event Log is less performsnt as it implies using the Windows event API rather than outputting to a file
I don't see any other option for us other than doing it and fetching via UF
This seems to have been the legacy approach for older TA versions
https://answers.splunk.com/comments/170572/view.html
