Ingesting query logs from Oracle Database

[vr2312]

Hello All

I am looking for options/solutions that would allow me to ingest queries run on an Oracle Database using Splunk.

Can anyone help me out with that ?

[jplumsdaine22 · Accepted solution]

There's two issues at play here. First, you need to actually capture the data within Oracle. Thats going to be dependent on your version is outside the scope of splunk answers - I would start here: http://www.dba-oracle.com/t_audit_sql_select_statements.htm

Once you have the data in your database, you can get it out by querying the sys.AUD$ table with the db connect app https://splunkbase.splunk.com/app/2686/

You'll need to create an input - the documentation is fairly easy to follow, if you get stuck there should be some previously answered questions here.

Just something to note the AUD$ table can become extremely large - you will probably want to truncate the table every 14 days or so

[vr2312]

Thank you so much for the info.

We have asked the DBA to move the data to the table which can be then ingested via DBConnect App.

[jplumsdaine22]

Do you mean you want to get the logs of the query metadata? Or you want to run SQL queries from splunk against an oracle database?

[vr2312]

The former.

If a user queries/actions using any statement on a DB, i would want the information available in Splunk.

Not sure if any query (even a SELECT) will be recorded at the DB End.