I am receiving JSON into Splunk in the following format. I'm trying to figure out how I can do searches to plot average values for this nested data. I need to be able to plot a line for each node over time, but I also need to be able to plot the average value for all nodes within a gateway over time. I don't know if I should be splitting up this data into multiple events as it comes into Splunk or whether my search should normalize all nodes to a common name as the id is in the data, and then try to split it up. Are there other options I haven't thought of yet? The list of nodes is a dynamic list, so I can't hardcode these node ids. gateway: "gateway1", nodes: { 1002: { id: 1002 } 11: { id: 11 value: 100 } , 14: { id: 11 value: 120 } } Help is really appreciated. ... View more

Hi, My application is written in C#. I see there are a few ways for getting data in: C# SDK (as per submit example) Logging.net with HTTP Event Collector Posting raw JSON to HTTP Event Collector Somehow posting directly to a TCP input (I can't figure out how to do this) I'm going to be indexing a lot of data and I'm trying to figure out the best method for doing this from my C# app in a threadsafe way. I've read through most of the documentation, but can't really tell what best practice is. It looks like HTTP EC may be the new recommended way. But is using logging .net really the most appropriate way of getting application data into Splunk? This seems more focused around getting application events into Splunk. ... View more