I am trying to send events from my Windows server .NET app to Splunk index via HTTP Event Collector. I was able to setup the collector and verified it from localhost and from another Linux machine by using simple curl commands as documented, so the collector is listening and is adding data to the index as supposed to do. However when trying to send events from .NET c# app I face the impossible. I tried all sample code Splunk made available, from simple to complex with no good results. Now, since the curl is working I am trying to do the very basic curl emulation in c# via a webrequest object. I am stuck now with the authentication. I tried various authentication headers but it seems none wants to work. The ones with encryption generates 400 Bad Request. The simple one from the code sample below generates 401 Unauthorized. I need some help to solve this issue. WebRequest request = WebRequest.Create("https://splunkserver:8088/services/collector/event"); request.Method = "POST"; request.Headers.Add("Authorization", "splunk 1EDC2170-023A-468A-9ADD-8A879755DC74"); ASCIIEncoding encoding = new ASCIIEncoding(); byte[] byte1 = encoding.GetBytes("this is a raw event line"); request.ContentLength = byte1.Length; Stream newStream = request.GetRequestStream(); newStream.Write(byte1, 0, byte1.Length); WebResponse response = request.GetResponse(); Stream dataStream = response.GetResponseStream();` StreamReader reader = new StreamReader(dataStream);` string serverResponse = reader.ReadToEnd(); ... View more

I enabled the HTTP Event Collector and I can see on my Centos 7 by running the ss -an command that it is listening only on 127.0.0.1 address. As a result the curl is working when calling 127.0.0.1:8088 and connection is refused when calling :8088 from the local ssh terminal Any idea how to fix this issue? ... View more

Hi, I followed instructions here: https://answers.splunk.com/answers/132016/process-flow-tracing-point-to-point-latency-calculation-visualisation-swim-lanes-is-it-possible.html to analyse users stuck on steps of my business process. My current search is: host="sp.dentfix.ro" | stats values(event) as step values(eval(strftime(_time, "%Y-%d-%m %H:%M"))) as times by id | mvcombine step | stats count by step I have a number of issues here: 1. the values(event) is listing values in alphabetical order, but I would like to see values in event time order (that is first event of every type). 2. Even more important, I have some events sp_alias where users get identified. The event contains fields id (as the new id) and oldId as former id of the user. How can I consolidate all oldId s with new id s and group by real users? ... View more