All Apps and Add-ons

How to ingest Microsoft .xel logs

Path Finder

I have a need to ingest certain SQL Server logs, in a proprietary .xel format, into Splunk.

Do I need to somehow first get these logs into a common file type/format before ingesting them? If so, how would I do that?


0 Karma


SPLUNK does not support ingestion of .xel format logs directly, but you can use the sys.fn_xe_file_target_read_file function on the SQL server side to convert the logs and may use DB Connect to ingest the data into SPLUNK .

Path Finder

Thanks for the response. Since I have a large number of servers, I'm trying to avoid using DB Connect. I was hoping for direct ingestion.

0 Karma



I am curious if you have found another way to accomplish this.    For us, going through audit functions to a blob storage on a heavily used azure sql database is beyond painful and completely impractical.   

0 Karma


You can do direct ingestion if they are text files, not proprietary .xel files. So if you can convert them beforehand, then yes

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...