Best way to log to SPLUNK

[ac931274]

Hello there,

I am using the nlog logging framework for my C# applications. Does anybody know of a logging target specifically for Splunk or the best way that I can send log messages to SPLUNK. I noticed that somebody has written one for the log4net framework. Does anybody know what layout it uses for sending the messages to Splunk?

Thanks in advance

Jonathan

[paul_1994]

Is there any examples out there that can show how it was done for someone just learning splunk other than documentation. I know all log4net instances are the same but it would be nice to see an example setup of a trans and props files.

This meant to be a comment..

Thanks

[jbsplunk · Accepted solution]

Hi Jonathan,

We do have people using log4net formats successfully in many cases, sometimes it is necessary to specify time format and location within props.conf when using this format, depending on how the log format is setup. For more details on that, see:

http://www.splunk.com/base/Documentation/4.2/admin/Propsconf

Some people have Splunk monitor the directory on the server where these files are written in close to real-time, others choose to send the files to a central location via some mechanism at regular intervals and have Splunk monitor that folder.

There isn't a single way to deal with this particular scenario, but for details you could start here:

http://www.splunk.com/base/Documentation/latest/Data/WhatSplunkcanmonitor

[mosmondor]

Does splunk API have some kind of nLog target module for splunking the data to indexer? That might prove useful.

[ac931274]

Thanks. Could you take a look at http://splunk-base.splunk.com/answers/23125/splunk-chews-xml-input so see where I have gone wrong?