https://community.splunk.com/t5/Splunk-Search/What-is-the-recommended-method-for-sending-multi-dimension/m-p/498024#M195698 <P>I've had a read of various methods for achieving this and find myself confused. As far as I can tell there are the following possibilities:</P> <OL> <LI>Use Splunk's .NET trace listeners to send to Splunk Cloud. However, the data sent is a simple string, not a set of user defined distinct dimensions.</LI> <LI>Go one level lower and use the Common library to send a serialisable object directly to Splunk's HTTP Event Collector. However, I can only find trivial sample code but not any decent C# API documentation that describes things such as batching etc.</LI> <LI>Write data to a file and use a Universal Forwarder. This comes with robustness out of the box (and seems to be the recommended approach), but I haven't found anything that describes required file format(s). Our requirement is for our application to log a variety of metrics each with their own set of dimensions - how is this achieved when writing to a file for the Forwarder to pick up?</LI> </OL> <P>So before I spend more time on evaluating whether Splunk Cloud is suitable for us, I'd like to know what is the recommended approach and where can I find details of how to achieve this (with actual links).</P> <P>Thanks</P> Thu, 30 Jan 2020 04:02:02 GMT insightseval 2020-01-30T04:02:02Z https://community.splunk.com/t5/Splunk-Search/What-is-the-recommended-method-for-sending-multi-dimension/m-p/498024#M195698 <P>I've had a read of various methods for achieving this and find myself confused. As far as I can tell there are the following possibilities:</P> <OL> <LI>Use Splunk's .NET trace listeners to send to Splunk Cloud. However, the data sent is a simple string, not a set of user defined distinct dimensions.</LI> <LI>Go one level lower and use the Common library to send a serialisable object directly to Splunk's HTTP Event Collector. However, I can only find trivial sample code but not any decent C# API documentation that describes things such as batching etc.</LI> <LI>Write data to a file and use a Universal Forwarder. This comes with robustness out of the box (and seems to be the recommended approach), but I haven't found anything that describes required file format(s). Our requirement is for our application to log a variety of metrics each with their own set of dimensions - how is this achieved when writing to a file for the Forwarder to pick up?</LI> </OL> <P>So before I spend more time on evaluating whether Splunk Cloud is suitable for us, I'd like to know what is the recommended approach and where can I find details of how to achieve this (with actual links).</P> <P>Thanks</P> Thu, 30 Jan 2020 04:02:02 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-recommended-method-for-sending-multi-dimension/m-p/498024#M195698 insightseval 2020-01-30T04:02:02Z