All Apps and Add-ons

How to configure input in DB Connect v3.1.2 for Splunk Add-on for Microsoft SQL Server using template mssql:audit ?


Hi I have been trying to set up the input on the DB Connect app "New Input" page using template mssql:audit template from the Splunk Add-on for Microsoft SQL Server add on but have not been able to progress much.

I am trying to figure out what would be the correct checkpoint value for the query below. I have tried lot of variations based on answers from other posts on this site, but none of the answers have proved useful in this case.

FROM sys.fn_get_audit_file ('C:\\\\SQLAudit\\\\*',default,default) 
WHERE event_time > ?
ORDER BY event_time ASC

W.r.t Timestamp, I have chosen "event_time" as preferred column, and specified time format as yyyy-MM-dd HH:mm:ss.
Input type : Rising Column
Please help.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...