Send event to Splunk Indexer from C#

[gmusumeci]

I’m using a .NET application that writes to Windows Event Log.

I want to send these events to the Splunk indexer. I tested both Splunk Universal Forwarder and Splunk Heavy Forwarder (5.x and 6.0). Both forwarders use lot of memory for a few events I need to send to the Splunk Indexer.

I like to modify the application to write directly to indexer, but here a few samples and little information on SDK to use them properly.

I spent several hours playing with the examples included on the SDK without any luck. Probably I’m missing something simple.

Anyone I have a C# sample code to send a Windows event or some text to Splunk indexer?

Thanks! Guillermo

[gkanapathy · Accepted solution]

There are several ways to send, but the easiest is to set up Splunk to listen on a plain TCP or UDP port, and have your program send out the log event to the server/port as a text string, i.e., just print a simple log line to the socket.

[gmusumeci]

Thank you for your response. The Indexer is listen on the default port. Do I need to add an extra port for this or can I send data the default port?

Do you have any C# code to help achieve this?

Thanks! Guillermo