Getting Data In
Highlighted

Best way to log to SPLUNK

Explorer

Hello there,

I am using the nlog logging framework for my C# applications. Does anybody know of a logging target specifically for Splunk or the best way that I can send log messages to SPLUNK. I noticed that somebody has written one for the log4net framework. Does anybody know what layout it uses for sending the messages to Splunk?

Thanks in advance

Jonathan

Tags (3)
Highlighted

Re: Best way to log to SPLUNK

Splunk Employee
Splunk Employee

Hi Jonathan,

We do have people using log4net formats successfully in many cases, sometimes it is necessary to specify time format and location within props.conf when using this format, depending on how the log format is setup. For more details on that, see:

http://www.splunk.com/base/Documentation/4.2/admin/Propsconf

Some people have Splunk monitor the directory on the server where these files are written in close to real-time, others choose to send the files to a central location via some mechanism at regular intervals and have Splunk monitor that folder.

There isn't a single way to deal with this particular scenario, but for details you could start here:

http://www.splunk.com/base/Documentation/latest/Data/WhatSplunkcanmonitor

View solution in original post

0 Karma
Highlighted

Re: Best way to log to SPLUNK

Explorer

Thanks. Could you take a look at http://splunk-base.splunk.com/answers/23125/splunk-chews-xml-input so see where I have gone wrong?

0 Karma
Highlighted

Re: Best way to log to SPLUNK

Path Finder

Does splunk API have some kind of nLog target module for splunking the data to indexer? That might prove useful.

0 Karma
Highlighted

Re: Best way to log to SPLUNK

Path Finder

Is there any examples out there that can show how it was done for someone just learning splunk other than documentation. I know all log4net instances are the same but it would be nice to see an example setup of a trans and props files.

This meant to be a comment..

Thanks