I’m using a .NET application that writes to Windows Event Log.
I want to send these events to the Splunk indexer. I tested both Splunk Universal Forwarder and Splunk Heavy Forwarder (5.x and 6.0). Both forwarders use lot of memory for a few events I need to send to the Splunk Indexer.
I like to modify the application to write directly to indexer, but here a few samples and little information on SDK to use them properly.
I spent several hours playing with the examples included on the SDK without any luck. Probably I’m missing something simple.
Anyone I have a C# sample code to send a Windows event or some text to Splunk indexer?
Thanks! Guillermo
There are several ways to send, but the easiest is to set up Splunk to listen on a plain TCP or UDP port, and have your program send out the log event to the server/port as a text string, i.e., just print a simple log line to the socket.
There are several ways to send, but the easiest is to set up Splunk to listen on a plain TCP or UDP port, and have your program send out the log event to the server/port as a text string, i.e., just print a simple log line to the socket.
Thank you for your response. The Indexer is listen on the default port. Do I need to add an extra port for this or can I send data the default port?
Do you have any C# code to help achieve this?
Thanks! Guillermo