How to load SQL Server extended events data to Splunk?


I have a requirement to monitor certain activities by few set of SQL Server logins. I will use SQL Server extended events to capture them.

I want to load the extended events data back to Splunk and create some alerts based on activities. Such as if a login attempts is tried more than 4 times, an alert should be generated in the real time.

Is there any way to connect to SQL Server to read extended events records from DMV or xel file or a stored procedure can be called from SQL Server and output can be loaded into Splunk?

Tags (1)


The Splunk DB Connect app is designed to connect to SQL databases and ingest data from them. I don't know if it will handle "extended events", but version 3 does support stored procedures. See

If this reply helps you, an upvote would be appreciated.
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!