Hi, Thanks for taking the time. start_lsn_hex and seqval_hex are internal counters for the CDC - counts transactions and actions within a transaction I think. No connection with the sql audit log so must use timespansearch.  We have to live with that, but so far it has not been a problem with many hits in the CDC-log. yes, I misplaced the extraction of the attributes; should have been in the append. Append because I want the event from windows events to be listed together with the CDC events that were found. Is there a way to not needing the second search against the windows event log? Thanks and regards, Bård ... View more

Messy... CDC-events - fetched from database to csv-files that are ingested by a forwarder most of the columns come from database attributes; they are many and usually only a very few should be displayed, The second column is "operasjon" (Norwegian for operation) which is updatebefore (values before the update) and updateafter (values after the update) "change_time","operasjon","databaseserver","databasenavn","tablename","start_lsn_hex","seqval_hex","__$start_lsn","__$end_lsn","__$seqval","__$operation","__$update_mask","KONTO_K","BUDSJ_AR","SOKTBEL","INNSTBEL","INNSTDAT","BEVBEL","FORBRUK","JUSTBEL","RGNSTA_K","ENDRDATO","ENDRINIT","PROSJNR","ORGBELOP","LOCK_FLAG","aretsBudsjettOverfortDato","__$command_id" "07.10.2026 16:10:49","updatebefore","sqlserver","prod_prosjekt","cdc.dbo_BUDSJETT_CT","0x000E7C290000600A0002","0x000E7C29000060050002","System.Byte[]","","System.Byte[]","3","System.Byte[]","8770","2026","0","1017","12.01.2026 08:55:17","0","0,00","","1","23.09.2026 10:51:00","bruker","359390","0","System.Byte[]","","1" "07.10.2026 16:10:49","updateafter","sqlsesrver","prod_prosjekt","cdc.dbo_BUDSJETT_CT","0x000E7C290000600A0002","0x000E7C29000060050002","System.Byte[]","","System.Byte[]","4","System.Byte[]","8770","2026","0","1018","12.01.2026 08:55:17","0","0,00","","1","23.09.2026 10:51:00","bruker","359390","0","System.Byte[]","","1"   ... View more

windows events originating from the sqlserver: 10/07/2026 04="10:45.857 PM" LogName=Application EventCode=33205 EventType=0 ComputerName=sqlserver.domain.no SourceName=MSSQLSERVER Type=Information RecordNumber=578434686 Keywords=Audit Success, Classic TaskCategory=None OpCode=None Comment: Message is interpreted as one field containing the rest of the event since key and value are separated by a colon (key:value) Comment: I have set up props.conf on the search head to extract them into fields Message=Audit event: audit_schema_version:1 event_time:2026-10-07 14:10:45.2482797 sequence_number:1 action_id:UP 21 additional attributes... session_server_principal_name:domain\bruker server_principal_name:domain\bruker server_principal_sid:010500000000000.... database_principal_name:dbo target_server_principal_name: target_server_principal_sid: target_database_principal_name: server_instance_name:sqlserver database_name:prod_prosjekt schema_name:dbo object_name:PROSJEKT statement:update budsjett set INNSTBEL=1016 where PROSJNR=999999 9 additional attributes ... obo_middle_tier_app_id: ... View more

And so, here is my (probably clumsy) attempt at the SPL: index=windowsevents EventCode=33205 SourceName=MSSQLSERVER (database_name=prod_prosjekt) (action_id="UP") (session_server_principal_name!=prod_prosjekt AND session_server_principal_name!="sa") | table _time, object_name, action_id, server_principal_name, statement | eval result_type="main_events" | eval attrs="extract commaseparated list of the attributes" append [search index=windowsevents EventCode=33205 SourceName=MSSQLSERVER database_name=prod_prosjekt action_id=UP (server_principal_name!=prod_prosjekt AND server_principal_name!="sa") | eval E=_time-3, L=_time+5, tabell="cdc.dbo_"+object_name+"_CT" | map search="search index=esak-audit tablename=$tabell$ earliest=$E$ latest=$L$ | fields _time, tablename, operasjon, client, <here I want to be able use attrs> | fields - _raw | eval result_type='audit_logs' " ]| sort - _time   ... View more

After these I will try to publish the search (I had to split the text for it to be accepted) Thanks and regards, Bård ... View more

Also the result is meant for normal users. The list of attributes needs to be dynamic because the update statements are different. So the only problem I have is how to display only the fields in attrs. ... View more

Then I want to use attrs from the main search in the map-command to display only those three attributes. The CDC-events contain very many attributes so displaying all of them will make the result unreadable. ... View more

The search is done using a timespan of 5 seconds around the _time of the event from the main search ... View more

Good morning and thanks for bearing over with me, The problem with the rejected message was presumably that it contained sqlcode. The primary search finds sql update statements from an index with windows events that are generated by an sqlserver. Then the attributes that are to be updated are extracted from the set-part of the sql update statement. (for example if a,y and z are the attributes to be updated then attrs is a comma separated list of the three) ... View more

I’m trying to dynamically show only the columns that were updated in a table, based on SQL update statements extracted from Windows events, joined to CDC rows for the same table. The goal is to list changed attributes with their before/after values, without showing all columns. ... View more

So I tried to post the explanation again and got this: Success! Click to go to your post.   and I clicked and got this: This reply was marked as spam and has been removed. If you believe this is an error, submit an abuse report. So I am lost.... ... View more

No, that was a test to see if my response to you arrived which this test did. I have tried to post a full explanation of what I want, but it seems to have been thrown away. ... View more

sorry - just a test ... View more

Thanks for the response - I shall have to take a look at TA-html-email. ... View more

We are here now: "Splunk App for Windows Infrastructure" version 1.3.0, so you are right - I upgraded it because I have a far more serious problem which I did not think had anything to do with this app, but I upgraded it anyway in the offchance that it did 🙂 ... View more

Thanks for your help; I disabled the "splunk_app_windows_infrastructure" - app and the "yellow warnings" went away. I have had this app installed for quite a time (albeit without it working :-)) so this "yellow warning" most likely came after the upgrade to 6.4.1. However this message keeps coming in the splund.log: 07-26-2016 02:15:32.082 +0200 WARN IntrospectionGenerator:resource_usage - RU - Failure executing PDH query, skipping getting iostats data this collection cycle. Status code is -2147481643 Regards Bård ... View more

Hi all, Thank you for the promtp response Damien. I have now managed to retrieve some attributes form a connection pool, but when I try to retrieve an attribute tagged with "[N/A]" (not available) in the mbean-browser as described below no events are indexed (ie not found by search). So the question is whether any of you have experienced anything like that? The following XML-element yields a result. <mbean domain="amx" properties="type=jdbc-connection-pool-mon,pp=/mon/server-mon[server],name=resources/JobRepositoryConnectionPool"> <attribute name="Name" outputname="namn5"/> <attribute name="averageconnwaittime" outputname="gjennomsnitt5"/> <attribute name="numconnnotsuccessfullymatched" outputname="matchet5"/> <attribute name="waitqueuelength" outputname="koelengde5"/> </mbean> returns this: {"namn5":"resources/JobRepositoryConnectionPool","gjennomsnitt5":{"count":68,"description":"Average wait-time-duration per successful connection request","lastSampleTime":1455744439833,"name":"AverageConnWaitTime","startTime":1455729117451,"unit":"millisecond"},"matchet5":{"count":0,"description":"Number of connections rejected during matching","lastSampleTime":-1,"name":"NumConnNotSuccessfullyMatched","startTime":1455729117451,"unit":"count"},"koelengde5":{"count":0,"description":"Number of connection requests in the queue waiting to be serviced.","lastSampleTime":-1,"name":"WaitQueueLength","startTime":1455729117451,"unit":"count"},"jvmDescription":"ATM eAdmin Glassfish","mbean_domain":"amx","mbean_property_name":"resources/JobRepositoryConnectionPool","mbean_property_pp":"/mon/server-mon[server]","mbean_property_type":"jdbc-connection-pool-mon"} However, if I try with the following element with the additional <attribute name="numconnacquired" outputname="numconnacquired6"/> nothing is returned by a search. <mbean domain="amx" properties="type=jdbc-connection-pool-mon,pp=/mon/server-mon[server],name=resources/JobRepositoryConnectionPool"> <attribute name="Name" outputname="namn6"/> <attribute name="averageconnwaittime" outputname="averageconnwaittime6"/> <attribute name="numconnnotsuccessfullymatched" outputname="numconnnotsuccessfullymatched6"/> <attribute name="waitqueuelength" outputname="waitqueuelength6"/> <attribute name="numconnacquired" outputname="numconnacquired6"/> </mbean> When I copy from the mbean-browser i Java Mission Control, the element is tagged with "[N/A]": Name Value Type Display Name Update Interval Description numconnacquired [N/A] CompositeData numconnacquired -1 No description available for getNumConnAcquired I have also tried the following XML to retrieve all data from the "java.lang"-domain: but only he following is returned: event1: {"Valid":true,"Name":"Metaspace Manager","MemoryPoolNames":["Metaspace","Compressed Class Space"],"ObjectName":"java.lang:type=MemoryManager,name=Metaspace Manager","jvmDescription":"ATM eAdmin Glassfish","mbean_domain":"java.lang","mbean_property_name":"Metaspace Manager","mbean_property_type":"MemoryManager"} event2: {"CommittedVirtualMemorySize":2661863424,"FreePhysicalMemorySize":4962947072,"FreeSwapSpaceSize":5793099776,"ProcessCpuLoad":0.0,"ProcessCpuTime":917750000000,"SystemCpuLoad":0.015635532699800114,"TotalPhysicalMemorySize":8589463552,"TotalSwapSpaceSize":9931640832,"Name":"Windows Server 2012 R2","Version":"6.3","AvailableProcessors":2,"Arch":"amd64","SystemLoadAverage":-1.0,"ObjectName":"java.lang:type=OperatingSystem","jvmDescription":"ATM eAdmin Glassfish","mbean_domain":"java.lang","mbean_property_type":"OperatingSystem"} Thanks for any help, Kind regards Bård Tørustad ... View more

I found that the following lines had been added to .../Splunk/etc/system/local/authorize.conf: [role_admin] importRoles = srchIndexesDefault = akseptanse;main;msad;perfmon;summary;windows;wineventlog;winevents srchMaxTime = 8640000 After having removed these lines the messages above do not occur in splunkd.log anymore. I do not know how those lines came to be added to authorize.conf (I did not do it myself explicitly :-)); maybe when I removed some app, or when I edited the role_admin - role to make the "Splunk app for Microsoft Windows infrastructure" work. Should this happen at all? ... View more

Version information: Splunk Version 6.2.1 Splunk Build 245427 ... View more