Splunk for Microsoft SQL Server, Part 1

[melissap]

View our Tech Talk: IT Edition-  Splunk for Microsoft SQL Server, Part 1 .

Splunk’s Add-on for Microsoft SQL Server is designed to help make monitoring your on-prem Microsoft SQL Servers easier. For this talk, we’re focusing on the Splunk Add-on for Microsoft SQL Server, designed to make collecting, monitoring and analyzing your Microsoft SQL Server data a breeze. 

Tune in to hear about:

• Collecting and analyzing data from your Microsoft SQL Servers.
• Set-up and out-of-the-box content in the TA.
• Tuning your inputs and searching on the fly.
• Building custom visualizations and alerts.

Tech Talk discussions remain open for two weeks following the live Tech Talk event. Have more questions?Check out the search for Splunk Add-on for Microsoft SQL Server in our community.

[melissap]

Here is the Q&A from the live session. Enjoy!

Q: How does this differ from Splunk DBX? Is it free with Splunk Enterprise?

A: The Splunk Add-on for Microsoft SQL Server is free on Splunkbase and collects the logging data and performance metrics from an MS SQL server running on a Windows host.

Q: Is it possible yet to configure Splunk DB Connect with a Search Head Cluster? Currently we have it configured on a single search head/heavy forwarder.

A: No, DB Connect is best suited to a heavy forwarder since there's no coordination between DB Connect nodes currently.

Q: Does DB connect work with SNOWFLAKE?

A:  DB Connect does not have a driver definition for a Snowflake JDBC driver. 

Q: Why collect via dbconnect instead of sending the audit events to win event log and ingest via uf?

A: Audit events are read from a log file, the DB Connect queries included in the Add-on are intended to collect things like users, databases, tables, and more.

Q: Is SQL-Server add-on supported by Splunk?

A: Yes, it's a Splunk Supported Add-on.