You may want to consider using a Splunk Forwarder on your SQL server. On the splunk forwarder configure your inputs.conf as normal, but you'll need to modify your maxkbps throughput limit, to prevent over indexing. limits.conf: [thruput] maxKBps = * If specified and not zero, this limits the speed through the thruput processor to the specified rate in kilobytes per second. * To control the CPU load while indexing, use this to throttle the number of events this indexer processes to the rate (in KBps) you specify. If you're reading from an open socket for your data instead of log files, you may also want to consider using persistentqueues to prevent dropping data if you cannot read/send fast enough. ... View more

try using chart instead of stats ? ... View more