I just setup DB Connect for the first time. I'm having trouble wrapping my head around how it operates. Every other input I have is from a Universal Forwarder - (I understand how they work.) DB Connect does not appear to use time/date stamps in the same way as a UF input. For example, I can create a SQL query within the DB Connect DataLab that returns the results I want. However, using dbxquery in a search string for a span over the past 24 hours, returns 3 year old events! | dbxquery connection=SQL query="SELECT * FROM SQLCrypto"."dbo"."ProcessLog" | where Message like "%[IsSuccess]:False%" Can anyone suggest how I can rein in my results to actually include only events in the past 24 hours? Ultimately, I am looking to create an alert which triggers once an hour for %[IsSuccess]:False% events. ... View more

I think I'm close on this, but I'm missing something; I have events forwarding to my indexer from MS SQL Audit via WinEventLog:Application. A number of fields are not being automatically extracted, so I'm relying on rex to pull out the values I need for an alert. There is a large, multi-line field called "Message" which contains all the values I need. Within "Message" are other values like object_name, database_name, user_name, etc. I have no trouble pulling the values I need into a search and creating a table, but I'm not clear how to use a rex-returned value as a condition to trigger an alert. The alert is only required if object_name:table1 or object_name:table2. Also if the "statement value is alter or create or delete, etc. Partial Search String (outputs values to a table - not shown) index=SQLAUDIT ComputerName=SERVER12 | search Message statement:alter OR statement:create OR statement:delete OR statement:drop OR statement:exec OR statement:insert OR statement:select OR statement:update | eval "Date - Time"=strftime(_time,"%F - %T") | rex "object_name:(?<TableID>.*)" | rex "statement:(?<AlertType>.+?)[\r]" | rex "database_name:(?<DBN>.*)" Data Sample Message=Audit event: event_time:2017-06-14 12:58:53.7376885 sequence_number:1 action_id:SL succeeded:true permission_bitmask:1 is_column_permission:true session_id:79 server_principal_id:2 database_principal_id:0 target_server_principal_id:0 target_database_principal_id:0 object_id:1201906778 class_type:U session_server_principal_name:DOMAIN\USER1234 server_principal_name:DOMAIN\USER1234 server_principal_sid:010500000000000567890093a2a241345661e2f43170a32821c0000 database_principal_name:public target_server_principal_name: target_server_principal_sid: target_database_principal_name: server_instance_name:SERVER12\DBMSSQL database_name:DB_NAME1 schema_name:db19 object_name:table_1 statement:select top 100 a.* , b.* from tableClosed a, table_1 b where a.flngAccountKey = b.flngAccountKey and a.fstrCaseType = 'TRPHD' ... View more

I'm running a very simple search to draw a table. One of the values returned is appearing twice in the table, but only occurs once in the event data. Is this a bug? Here is the search string; index=* host=serverhostname EventCode=33205 | table ComputerName, statement The result in the table is the value for 'statement' appears twice. I get two events returned, with two lines each but only the 'statement' value is doubled. All other fields are blank on the second line. Here is the event data that is being queried; 10/17/2016 12:20:25 PM LogName=Application SourceName=MSSQL$OTPMSSQL EventCode=33205 EventType=0 Type=Information ComputerName=HOSTNAME.FQDN TaskCategory=None OpCode=None RecordNumber=904492 Keywords=Audit Success, Classic Message=Audit event: event_time:2016-10-17 16:20:24.1512330 sequence_number:1 action_id:AL succeeded:true permission_bitmask:0 is_column_permission:false session_id:136 server_principal_id:276 database_principal_id:1 target_server_principal_id:0 target_database_principal_id:0 object_id:8 class_type:DB session_server_principal_name:DOMAIN\USERID server_principal_name:DOMAIN\USERID server_principal_sid:010500000000000515000000093a2a2426761e2f43170a326b1e0000 database_principal_name:dbo target_server_principal_name: target_server_principal_sid: target_database_principal_name: server_instance_name:SERVERNAME\OTPMSSQL database_name:DBA schema_name: object_name:DBA statement:ALTER DATABASE [DBA] MODIFY FILE ( NAME = N'DBA_log', FILEGROWTH = 1048576KB ) additional_information: . Collapse ... View more