Here's the code I used:
public bool SplunkExport(List<string> messages)
{
ServicePointManager.ServerCertificateValidationCallback = new System.Net.Security.RemoteCertificateValidationCallback(AcceptAllCertifications);
string baseuri = "https://" + ip + ":" + port;
string uri = "/services/collector";
HttpWebRequest client = (HttpWebRequest)WebRequest.Create((baseuri + uri));
client.ContentType = "application/json; charset=utf-8";
client.Method = "POST";
client.Headers["Authorization"] = "Splunk " + SplunkToken;
client.Headers["x-splunk-input-mode"] = "streaming";
try
{
using (Stream streamWriter = client.GetRequestStream())
{
foreach (var message in messages)
{
var m = "{\"sourcetype\":\"" + type + "\", \"host\":\"" + host + "\",\"event\": " + message + "}";
byte[] bytes = Encoding.UTF8.GetBytes(m);
streamWriter.Write(bytes, 0, bytes.Length);
streamWriter.Flush();
}
var httpResponse = (HttpWebResponse)client.GetResponse();
using (var streamReader = new StreamReader(httpResponse.GetResponseStream()))
{
var result = streamReader.ReadToEnd();
}
}
return true;
}
catch
{
return false;
}
}
The messages list is a list of events in JSON format.
... View more
