Splunk Search

Ingesting query logs from Oracle Database

vr2312
Contributor

Hello All

I am looking for options/solutions that would allow me to ingest queries run on an Oracle Database using Splunk.

Can anyone help me out with that ?

0 Karma
1 Solution

jplumsdaine22
Influencer

There's two issues at play here. First, you need to actually capture the data within Oracle. Thats going to be dependent on your version is outside the scope of splunk answers - I would start here: http://www.dba-oracle.com/t_audit_sql_select_statements.htm

Once you have the data in your database, you can get it out by querying the sys.AUD$ table with the db connect app https://splunkbase.splunk.com/app/2686/

You'll need to create an input - the documentation is fairly easy to follow, if you get stuck there should be some previously answered questions here.

Just something to note the AUD$ table can become extremely large - you will probably want to truncate the table every 14 days or so

View solution in original post

0 Karma

jplumsdaine22
Influencer

There's two issues at play here. First, you need to actually capture the data within Oracle. Thats going to be dependent on your version is outside the scope of splunk answers - I would start here: http://www.dba-oracle.com/t_audit_sql_select_statements.htm

Once you have the data in your database, you can get it out by querying the sys.AUD$ table with the db connect app https://splunkbase.splunk.com/app/2686/

You'll need to create an input - the documentation is fairly easy to follow, if you get stuck there should be some previously answered questions here.

Just something to note the AUD$ table can become extremely large - you will probably want to truncate the table every 14 days or so

0 Karma

vr2312
Contributor

Thank you so much for the info.

We have asked the DBA to move the data to the table which can be then ingested via DBConnect App.

0 Karma

jplumsdaine22
Influencer

Do you mean you want to get the logs of the query metadata? Or you want to run SQL queries from splunk against an oracle database?

0 Karma

vr2312
Contributor

The former.

If a user queries/actions using any statement on a DB, i would want the information available in Splunk.

Not sure if any query (even a SELECT) will be recorded at the DB End.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...