Splunk Dev

Can someone show an example of sending data through TCP to a Splunk server using the C# SDK?

ConnorG
Path Finder

Could someone show an example of sending data through a TCP connection to a Splunk server using the C# sdk?

There are examples for python and Java, but none for C#.

I'm currently using the event streaming method with receiver.attach, but it's much too slow for my requirements.

Tags (3)
1 Solution

ConnorG
Path Finder

Figured it out. Turned out to be pretty simple to implement. Just have to be sure to set up Splunk for receiving on the specific TCP port.

        oSocket = service.Open(portNumber);
        var bytes = Encoding.UTF8.GetBytes(message);
        oSocket.Send(bytes);

View solution in original post

ConnorG
Path Finder

Figured it out. Turned out to be pretty simple to implement. Just have to be sure to set up Splunk for receiving on the specific TCP port.

        oSocket = service.Open(portNumber);
        var bytes = Encoding.UTF8.GetBytes(message);
        oSocket.Send(bytes);

demodav
Path Finder

@ConnorG Could you post your whole solution?

0 Karma

paulwrussell
Explorer

Has anyone figured out how to do this in C#?

0 Karma

ConnorG
Path Finder

@demodav you can find my solution here:

https://github.com/ConnorRules/Dynatrace-Plugin-Splunk-Forwarder/blob/master/src/com/compuware/Splun...

The parts you'll want to look at in particular are:
line 106 - setting up the login arguments
line 113 - creating a service instance that is connected to the splunk server
line 184 - getting the output stream to a specific index
line 214 - writing to that stream

Should be pretty self explanatory. Let me know if you have any questions.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Does the 'submit' example here not meet that need?

ConnorG
Path Finder

The submit example from the SDK is using HTTP Post (REST API) to ship the data. This method is insufficient for moving large amounts of data to the Splunk server.

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...