https://community.splunk.com/t5/Splunk-Dev/How-to-load-SQL-Server-extended-events-data-to-Splunk/m-p/369781#M6032 <P>The Splunk DB Connect app is designed to connect to SQL databases and ingest data from them. I don't know if it will handle "extended events", but version 3 does support stored procedures. See <A href="https://splunkbase.splunk.com/app/2686/">https://splunkbase.splunk.com/app/2686/</A></P> Wed, 22 Mar 2017 13:54:41 GMT richgalloway 2017-03-22T13:54:41Z https://community.splunk.com/t5/Splunk-Dev/How-to-load-SQL-Server-extended-events-data-to-Splunk/m-p/369780#M6031 <P>I have a requirement to monitor certain activities by few set of SQL Server logins. I will use SQL Server extended events to capture them. </P> <P>I want to load the extended events data back to Splunk and create some alerts based on activities. Such as if a login attempts is tried more than 4 times, an alert should be generated in the real time. </P> <P>Is there any way to connect to SQL Server to read extended events records from DMV or xel file or a stored procedure can be called from SQL Server and output can be loaded into Splunk?</P> Wed, 22 Mar 2017 12:21:04 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-load-SQL-Server-extended-events-data-to-Splunk/m-p/369780#M6031 stripadba 2017-03-22T12:21:04Z https://community.splunk.com/t5/Splunk-Dev/How-to-load-SQL-Server-extended-events-data-to-Splunk/m-p/369781#M6032 <P>The Splunk DB Connect app is designed to connect to SQL databases and ingest data from them. I don't know if it will handle "extended events", but version 3 does support stored procedures. See <A href="https://splunkbase.splunk.com/app/2686/">https://splunkbase.splunk.com/app/2686/</A></P> Wed, 22 Mar 2017 13:54:41 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-load-SQL-Server-extended-events-data-to-Splunk/m-p/369781#M6032 richgalloway 2017-03-22T13:54:41Z