Splunk Dev

How to send logs in Windows

bee
New Member

Hi, 

I try to send logs my Windows server to Splunk via Powershell but I have this type of error :   Cannot convert value to type System.String.

This is my code :

# Function to send log files with HEC
function Send-LogToSplunk {
param (
[string]$filePath
)

$logContent = Get-Content -Path $filePath -Raw
$fileName = [System.IO.Path]::GetFileName($filePath)
$fileDirectory = [System.IO.Path]::GetDirectoryName($filePath)

$splunkServer = "$splunkHost/services/collector/event"
$header = @{"Authorization" = "Splunk $splunkToken"}

$payload = @{
event = $logContent
host = $env:COMPUTERNAME
sourcetype = "log"
source = $filePath
} | ConvertTo-Json


#Write-Host "Log Content $logContent";
#Write-Host "Payload to be sent: $payload";
Write-Host "FileDirectory $fileDirectory";

try {

$response = Invoke-RestMethod -Method Post -Uri $splunkServer -Headers $header -Body $payload

Write-Host "Log sent successfully: $fileName"
} catch {
Write-Host "Failed to send log: $filePath Code Error: '$global:errorConnectionCode'"
Write-Host "Error details: $_"
Exit $global:errorConnectionCode
}
}

Thanks in advance

Labels (1)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. It's more of a PowerShell question than a Splunk one.

2. For simple file monitoring it's easier to use UF (or other solutions capable of writing to a HEC endpoint if you find UF "too big" or "too closed source").

3. You haven't even told us at which point this error is raised.

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...