Splunk - How to generate an “identity column” id 1,2,3...

[gunnist]

We're logging info/error logs in splunk/db. We're using .net and nlog.

In db, we're getting it in the right order when sorting because of identity column.

In Splunk, it's coming out of order if many log entries have the same date.

Is there a chance to tell splunk to create a "identity column" for everything that is piped into it? We're piping the logs into Splunk using HTTP Event Collector.

Thank you!

Gunnar

[s2_splunk]

No, not really. A Splunk indexing tier usually consists of many indexers, all receiving data from various sources independently. There is no coordinating service that can produce such an event sequence number. You would have to include such a unique order key in your source data and use that to sort when searching, if timestamp granularity is not enough to maintain time series order.