Getting Data In

Best way to log to SPLUNK

ac931274
Explorer

Hello there,

I am using the nlog logging framework for my C# applications. Does anybody know of a logging target specifically for Splunk or the best way that I can send log messages to SPLUNK. I noticed that somebody has written one for the log4net framework. Does anybody know what layout it uses for sending the messages to Splunk?

Thanks in advance

Jonathan

Tags (3)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Hi Jonathan,

We do have people using log4net formats successfully in many cases, sometimes it is necessary to specify time format and location within props.conf when using this format, depending on how the log format is setup. For more details on that, see:

http://www.splunk.com/base/Documentation/4.2/admin/Propsconf

Some people have Splunk monitor the directory on the server where these files are written in close to real-time, others choose to send the files to a central location via some mechanism at regular intervals and have Splunk monitor that folder.

There isn't a single way to deal with this particular scenario, but for details you could start here:

http://www.splunk.com/base/Documentation/latest/Data/WhatSplunkcanmonitor

View solution in original post

0 Karma

paul_1994
Path Finder

Is there any examples out there that can show how it was done for someone just learning splunk other than documentation. I know all log4net instances are the same but it would be nice to see an example setup of a trans and props files.

This meant to be a comment..

Thanks

jbsplunk
Splunk Employee
Splunk Employee

Hi Jonathan,

We do have people using log4net formats successfully in many cases, sometimes it is necessary to specify time format and location within props.conf when using this format, depending on how the log format is setup. For more details on that, see:

http://www.splunk.com/base/Documentation/4.2/admin/Propsconf

Some people have Splunk monitor the directory on the server where these files are written in close to real-time, others choose to send the files to a central location via some mechanism at regular intervals and have Splunk monitor that folder.

There isn't a single way to deal with this particular scenario, but for details you could start here:

http://www.splunk.com/base/Documentation/latest/Data/WhatSplunkcanmonitor

0 Karma

mosmondor
Path Finder

Does splunk API have some kind of nLog target module for splunking the data to indexer? That might prove useful.

0 Karma

ac931274
Explorer

Thanks. Could you take a look at http://splunk-base.splunk.com/answers/23125/splunk-chews-xml-input so see where I have gone wrong?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...