You're talking about changing the actual database audit data where the OS user is recorded, not just how Splunk reports on it. Unfortunately I don't think this is something that can be changed, as it is internal to the way Oracle records audit data. The problem I see is that under your current arrangement you effectively have users connecting to a group DB account from a group OS account, which makes accurate auditing pretty much impossible. A better policy would be to have users connect directly from their own accounts instead of using "su - oracle" first. The oracle OS account should really only be used for software maintenance and certain types of batch automation at most. That would allow the OS userid recorded in the audit trail to accurately reflect the true user. The same is true of the SYSTEM database account; it really shouldn't be used for much of anything. Consider granting necessary privileges (and ONLY the minimum necessary privileges) to individual user accounts, if possible, and locking the SYSTEM account entirely. If users really must connect to a group database account, then consider using proxy connections as described here. That way the XML audit trail will record the proxy username as well as the database account username, plus users don't have to know the actual password of the group account. ... View more

From the error message it appears that the database name is not being passed to the search. The search should contain something like database="dbname" not a null value for the database. I'm not sure what would cause this to happen, but you might want to check your database.conf file and make sure the connection is defined correctly. ... View more

The "index" parameter in your inputs.conf file should name the Splunk index in which your data will be stored; unless your index is named "true", you probably need something else here. Make sure you have created an index on the indexer to hold the data, and that it is named here. See this documentation for an example of what should be in inputs.conf. You should also have an "outputs.conf" file defined that tells the forwarder where to send its data. See the documentation here for more information on outputs.conf. ... View more

I believe that the UI only controls what is collected on the local indexing server or search head where it is installed. It does not configure distributed apps directly. If you configure the add-on as a distributed app you can change the inputs.conf file on your distribution server (one place) and push it out to all your remote forwarders that way. ... View more

It's hard to say for sure, but my best guess based on what you've shared is that something is now being routed to the proxy that shouldn't be - such as a call to localhost or some such that the proxy doesn't know how to handle, so the connection times out. ... View more

Have you looked at the AS/400 app for Splunk? There are a number of related questions on this site, as well. ... View more

You can also check out this paper for more information on a variety of ways to get Oracle data into Splunk. If you want to report database changes in real-time, then db-tail may not be the best option. db-tail can capture incremental changes, but it still runs like a scheduled job - at most once per minute - and runs a query on your data that will put some minimal additional load on your system. If that is close enough to real-time for you, then it is probably the easiest option. If you need closer to real-time, then your best bet would be a PL/SQL trigger or some such that would transmit the data directly to Splunk on a TCP input. There is some risk of data being lost that way (if packets were lost on the network or if the trigger failed for some reason) but it would be as close to real-time as you could get. There is an example of how to set this up in the paper. ... View more

It is important to note that the monitoring described in the white paper is NOT a core feature of Oracle database. It requires separate licensing of the Oracle Tuning Pack for Enterprise Manager. If you use these views and you don't have a license and Oracle audits you (yes, they do that) then they can send you a BIG bill. Also worth noting is that any information in V$ views is highly volatile. A DB Connect input would have to run at the most frequent rate - once per minute - to pick up everything you wanted to see, and even then might not get everything. I would recommend looking into Oracle STATSPACK. It's a free option that may provide the sort of information you're looking for. ... View more

For a starting tutorial on monitoring Oracle with Splunk, try Log File Analysis for Oracle 11g. It describes most of the things you are asking about. If your Splunk installation will not be located on the same server as your Oracle database and SQL commands through DB Connect will not work to get the data you need, then you will also need to look at using the Universal Forwarder. ... View more

A basic tutorial on configuring Splunk monitoring for Oracle can be found here: https://apps.splunk.com/app/1538. ... View more

Check out the following documentation and blog posts, which talk about how to use database repository views for EM. These views should be accessible using Splunk DB Connect. Enterprise Manager Cloud Control Management Repository Views Reference OEM 12c repository views Oracle Enterprise Manager 12c Metrics Monitoring and Management Repository Views: Tips and Tricks ... View more

The actual search should probably look something like this for tickets closed in the last week (my syntax is for Oracle): | dbquery "dbname" "select to_char(DateClosed,'YYYY-MM-DD HH24:MI:SS') DateClosed, TicketID from TableA where DateClosed>trunc(sysdate-7) group by DateClosed" | timechart span=1d sum(TicketID) by DateClosed This will allow you to timechart the number of tickets closed by any span size you want. ... View more

I begin to see the difficulty. I haven't tried this - perhaps you have already - but would something like this work? /apps/oracle/install/admin/instances/${hostname}* You just need a common environment variable that returns the hostname... ... View more

I use wildcards for similar situations. For instance, I pick up alert log files for Oracle with something like this: monitor:///apps/oracle/diag/rdbms/*/*/trace/alert*.log This picks up all alert logs on the system for every database, including any that I might add in the future, with one input. In your case I would think something like this would work: /apps/oracle/install/admin/instances/ovdpmmk* ... View more

I haven't used SQLServer in a long time, but as I recall a lot of what it records goes into the Windows system logs. The Splunk App for Windows Infrastructure or the Universal Forwarder should be able to pick up those records. For anything getting written to an actual log file it should just be a matter of creating a custom file input and directing the data to an index, as described here. ... View more