Splunk Enterprise Security

MSSQL Server TA - audit events scalability over hundreds of DBs

splunk_zen
Builder

According to
https://docs.splunk.com/Documentation/AddOns/released/MSSQLServer/SQLServerconfiguration
Audit events get written into a binary file C:\SQLAudit which then gets read via a DB connect query.
This is problematic when we need to monitor hundreds of different MSSQL Server DBs and would imply us setting up several HFs just for this tech stack alone (as well as very infrequent ingestion queries which doesn't seem a great fit for ES)

Even though writing audit events via Windows Event Log is less performsnt as it implies using the Windows event API rather than outputting to a file
I don't see any other option for us other than doing it and fetching via UF
This seems to have been the legacy approach for older TA versions
https://answers.splunk.com/comments/170572/view.html

0 Karma

splunk_zen
Builder

anyone please?

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...