With the help of co-workers I have found whats causing the issue and created a solution (or rather a workaround) for it. The actual issue: The HEC Sender uses an HEC Info object to store events and the timestamp of the message. According to this github-repo this is the way that the timestamp is serialized: public HttpEventCollectorEventInfo(DateTime datetime, string id, string severity, string message, object data, Metadata metadata) { double epochTime = (datetime - new DateTime(1970, 1, 1)).TotalSeconds; // truncate to 3 digits after floating point Timestamp = epochTime.ToString("#.000", Thread.CurrentThread.CurrentCulture); this.metadata = metadata ?? new Metadata(); Event = new LoggerEvent(id, severity, message, data); } Very important - it uses Thread.CurrentThread.CurrentCulture to format the string. Our app uses the german culture, where we use a comma instead of a dot for the decimal separator. The Splunk Server seems to be confused by that and thus always throws out the beforementioned error. This practically means that the HEC Sender class is completely unusable with a german culture context. There is no way to directly influence the  string formatting, nor can I disable the generation of the timestamp inside the HEC Info Class. For me this seems to be either a bug on the side of the Splunk Server or the HEC Sender. To test this hypothesis, I used curl to replicate this error and sent one message with the comma as the decimal separator and with the dot as the decimal separator: curl "https://<server>/services/collector" -H "Authorization: Splunk <token>" -d "{\"time\":\"1651494076,162\",\"event\":\"testing\"}" // Response: {"text":"Error in handling indexed fields","code":15,"invalid-event-number":0} curl "https://<server>/services/collector" -H "Authorization: Splunk <token>" -d "{\"time\":\"1651494076.162\",\"event\":\"testing\"}" // Response: {"text":"Success","code":0} Solution / Workaround: My current workaround is temporarily changing the Culture when I use the HEC Sender. I use a helpful construction that I found here to nest it in a using-context. At the moment my code looks roughly like this: using (CultureInfo.GetCultureInfo("en-US").AsCurrent()) { ecSender.Send(Guid.NewGuid().ToString(), "INFO", null, <message>); } With the following helper implementation that automatically stores and changes the culture for me: public static class CultureInfoExtensions { public static IDisposable AsCurrent(this CultureInfo culture) { return new CultureRunner(culture); } } public class CultureRunner : IDisposable { readonly CultureInfo originalCulture; readonly CultureInfo originalUICulture; public CultureRunner(CultureInfo culture) { if (culture == null) throw new ArgumentNullException(nameof(culture)); originalCulture = Thread.CurrentThread.CurrentCulture; originalUICulture = Thread.CurrentThread.CurrentUICulture; Thread.CurrentThread.CurrentCulture = culture; Thread.CurrentThread.CurrentUICulture = culture; } public void Dispose() { Thread.CurrentThread.CurrentCulture = originalCulture; Thread.CurrentThread.CurrentUICulture = originalUICulture; } } I'm changing not only CurrentThread.CurrentCulture property but also the CurrentUICulture, to keep both synced for the time of the change. If anyone has a better idea or a better workaround, please let me know! I hope I could help someone with this. ... View more