Splunk Dev

How can I access the TraceId generated by Splunk OpenTelemetry Collector within an ASP.NET web application?

codeninja
Engager

In the current project, we are sending application logs to Splunk, while the splunk-otel-collector is responsible for sending instrumentation logs to SignalFx. The issue arises because we utilize the cloudFrontID as a correlation ID to filter logs in Splunk, whereas SignalFx employs the traceId for log tracing. I am currently facing challenges in correlating the application logs' correlation ID with SignalFx's traceId.

I attempted to address this issue by using the "Serilog.Enrichers.Span" NuGet package to log the TraceId and SpanId. However, no values were logged in Splunk. How can I access the TraceId generated by the OpenTelemetry Collector within the ASP.NET web application (Framework version: 4.7.2)?

Let me know if further details are required from my end.

0 Karma
1 Solution

codeninja
Engager

To inject trace context fields in logs, enable log correlation by setting the SIGNALFX_LOGS_INJECTION environment variable to true before running your instrumented application.

Reference: https://github.com/signalfx/signalfx-dotnet-tracing/blob/main/docs/correlating-traces-with-logs.md

After enabling this environment variable: SIGNALFX_LOGS_INJECTION, I was able to see the traceId values in Splunk.

View solution in original post

0 Karma

codeninja
Engager

To inject trace context fields in logs, enable log correlation by setting the SIGNALFX_LOGS_INJECTION environment variable to true before running your instrumented application.

Reference: https://github.com/signalfx/signalfx-dotnet-tracing/blob/main/docs/correlating-traces-with-logs.md

After enabling this environment variable: SIGNALFX_LOGS_INJECTION, I was able to see the traceId values in Splunk.

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...