Getting Data In

Send event to Splunk Indexer from C#

gmusumeci
New Member

I’m using a .NET application that writes to Windows Event Log.

I want to send these events to the Splunk indexer. I tested both Splunk Universal Forwarder and Splunk Heavy Forwarder (5.x and 6.0). Both forwarders use lot of memory for a few events I need to send to the Splunk Indexer.

I like to modify the application to write directly to indexer, but here a few samples and little information on SDK to use them properly.

I spent several hours playing with the examples included on the SDK without any luck. Probably I’m missing something simple.

Anyone I have a C# sample code to send a Windows event or some text to Splunk indexer?

Thanks! Guillermo

Tags (4)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There are several ways to send, but the easiest is to set up Splunk to listen on a plain TCP or UDP port, and have your program send out the log event to the server/port as a text string, i.e., just print a simple log line to the socket.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

There are several ways to send, but the easiest is to set up Splunk to listen on a plain TCP or UDP port, and have your program send out the log event to the server/port as a text string, i.e., just print a simple log line to the socket.

0 Karma

gmusumeci
New Member

Thank you for your response. The Indexer is listen on the default port. Do I need to add an extra port for this or can I send data the default port?

Do you have any C# code to help achieve this?

Thanks! Guillermo

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...