How to log records being viewed by custom web app users?

[aklare]

How can we log records being viewed by custom web app users to Splunk?  We need to log web app data usage info such as what user took what action on what record at what time.  We have been told to have our web app code write entries to the Windows Event Viewer which we can easily do but we don't want to write to an existing Application log and muddy up the information logged there.  There is the idea of creating a custom Event Viewer log but that requires a registry change on all machines where we would need to do this and we don't directly have those permissions.  And any new servers being set up would need to have this change made also.  Seems like a hassle to maintain.  Is there a better way to write custom usage data to Splunk?

[richgalloway]

I see three options for logging the records:

1) Write them to a local file and have a locally-installed Universal Forwarder send them to Splunk.

2) Write them directly to Splunk using the HTTP Event Collector (HEC).

3) Use syslog to send them to a syslog collector for forwarding to Splunk.