Since I have seen some posts that say that SQL Logs are the way to go, and TCP inputs have the possibility of losing data if the splunk server were to go down. I am going to say that the better way is through MSSQL as it will pick up where it left off.
Since I have seen some posts that say that SQL Logs are the way to go, and TCP inputs have the possibility of losing data if the splunk server were to go down. I am going to say that the better way is through MSSQL as it will pick up where it left off.