Splunk Dev

Can Splunk read data from Aud$ and FGA_LOG$ ,can it be used to replace Oracle Audit vault

pradeep2210
New Member

looking for the these information to pull live data from oracle database. Can it also pull the data from xml file.
any limit on the data length and character

Tags (1)
0 Karma

pmdba
Builder

This will depend somewhat on what version of Oracle you are running. Oracle 11g can write audit records to text or xml files or syslog, or keep them in the database where you can index them using Splunk DBConnect. Starting with Oracle 12c, audit records are only stored in a new unified audit trail table and no longer written to external files, so DBConnect will be your only option. In general Splunk doesn't have any limit on the amount or size of data ingested. If you can read the file or run the SQL query Splunk can index the results.

That said, if you have any concerns about bumping into your Splunk license limit, I would advise reading audit records from syslog or Oracle's .aud text files and avoiding XML. The XML tags make it easy for Splunk to identify fields, but will consume twice as much of your license pulling in those extra characters. If you are running SQL queries, consider which columns from the audit tables you want to include; you can save overhead on your license if you can exclude some of them.

It's a little dated (DB Connect is on version 3.0 now), but the following add-on can explain the basics of pulling in data from a variety of Oracle related sources. Log File Analysis for Oracle 11g.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...