Splunk Enterprise

UF Batch Import Unreadable File Type Error

mikefg
Communicator

I have some SQL audit files  filename.sqlaudit that I want to import using batch. I have the configuration all done and working for test files like a .txt file, but the .sqlaudit file will not import.

Running '.\splunk.exe list inputstatus' give me 'type = unreadable file type'.

I have the Splunk Add-on for Microsoft SQL Server installed on the search head, so that should parse the file once it's imported, correct?

How do I get the UF to process the file?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
As I understand it, .sqlaudit files are binary rather than text, which is why Splunk won't read them.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...