Developing for Splunk Enterprise

How to load SQL Server extended events data to Splunk?


I have a requirement to monitor certain activities by few set of SQL Server logins. I will use SQL Server extended events to capture them.

I want to load the extended events data back to Splunk and create some alerts based on activities. Such as if a login attempts is tried more than 4 times, an alert should be generated in the real time.

Is there any way to connect to SQL Server to read extended events records from DMV or xel file or a stored procedure can be called from SQL Server and output can be loaded into Splunk?

Tags (1)


The Splunk DB Connect app is designed to connect to SQL databases and ingest data from them. I don't know if it will handle "extended events", but version 3 does support stored procedures. See

If this reply helps you, an upvote would be appreciated.
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>