Database queries

[RJ2]

From Splunk, can I see the queries that have been implemented in the database?

like update, delete, insert, etc.?

[inventsekar]

Hi @RJ2 

Splunk does not uses any database.
It uses some simple "flat files" and some bigdata map reduce algorithms at the backend. 

so we can not find out the queries of delete, update, etc

hope its clear to you, if you have further questions, pls let us know. 

upvotes appreciated, if a reply solved your issue, pls accept it as the solution, thanks. 

Best Regards,

Sekar

[RJ2]

YES, BUT HOW? 

[PickleRick]

1. Please don't shout.

2. It depends on what kind of data you have. Without knowing that we can't help you. Properly deployed Splunk infrastructure should have some docummented inventory of the sources ingested, sourcetypes, destination indexes and so on.

3. Also just because you can log in to your Splunk server doesn't mean you have access rights to the indexes containing information you need. You have to consult with your local Splunk admin about it.

[PickleRick]

What do you mean? You want to see what queries your users run against your database server? Do you have apropriate logging set up in your database server? Do you ingest logs from that database server to your Splunk installation? If an answer to all those questions is "yes", you should have your database activity logs in your Splunk environment and should be able to search through that data.