Getting Data In

How to send visual studio application log to Splunk Enterprise instance?

j_rajesh
New Member

I have installed Splunk Enterprise. Need to know the basic steps to send log data from my standalone visual studio application.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I'm assuming Splunk is installed on a separate server that visual studio is installed on?

If so then install a Splunk Universal Forwarder on the server with visual studio. Once installed, go back to the server where Splunk is installed and configure it to receive traffic via port 9997 by Settings > Forwarding and Receiving > Configure Receiving > New > Add 9997

You can also create a new index while on this server (I'd recommend doing so)

Now go back to the server where you installed the Splunk forwarder, go under $SPLUNK_HOME/etc/apps/search/local and create 2 files.. The first file is called inputs.conf and the second file will be called outputs.conf

Inputs.conf

[monitor://PATH_TO_YOUR_LOG_FILE]
index=YOUR_INDEX_NAME
sourcetype=YOUR_SOURCETYPE

Outputs.conf

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
disabled = false
server = YOUR_INDEXER_IP_ADDRESS:9997

Restart Splunkd on the forwarder after making these changes by going to $SPLUNK_HOME/bin and ./splunk restart

http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Getstartedwithgettingdatain

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...