Configuring the sink - serilog-contrib/serilog-sinks-splunk GitHub Wiki

To get started install the Serilog.Sinks.Splunk package from Visual Studio's NuGet console:

PM> Install-Package Serilog.Sinks.Splunk

Log using the Event Collector

Using the new Event Collector in Splunk 6.3, you would configure a sink using:

var log = new LoggerConfiguration()
    .WriteTo.EventCollector(
        "https://mysplunk:8088/services/collector", "myeventcollectortoken")
    .CreateLogger();

Inject a compact Splunk Json formatter for EventCollector

By default, the formatter used is a SplunkJsonFormatter. If you are in the need of logging the events to Splunk in compact format, you can inject and existing formatter, or your custom made.

Note. Sample is for EventCollector but similar construct exist for TCP & UDP.

var log = new LoggerConfiguration()
    .WriteTo.EventCollector(
        "https://mysplunk:8088/services/collector", "myeventcollectortoken",
        new CompactSplunkJsonFormatter(),
        //OPTIONALS (defaults shown)
        restrictedToMinimumLevel: LevelAlias.Minimum)
    .CreateLogger();

Log using TCP

To setup logging to Splunk using TCP, the simplest construct would be:

var log = new LoggerConfiguration()
    .WriteTo.SplunkViaTcp(
        host: "127.0.0.1",
        port: 10001,
        //OPTIONALS (defaults shown)
        restrictedToMinimumLevel: LevelAlias.Minimum,
        formatProvider: null,
        renderTemplate: true)
    .CreateLogger();

Log using UDP

To setup logging to Splunk using UDP, the simplest construct would be:

var log = new LoggerConfiguration()
    .WriteTo.SplunkViaUdp(
        host: "127.0.0.1",
        port: 10000,
        //OPTIONALS (defaults shown)
        restrictedToMinimumLevel: LevelAlias.Minimum,
        formatProvider: null,
        renderTemplate: true)
    .CreateLogger();

Inject a custom message formatter

By default, the formatter used is a JsonFormatter. If you are in the need of logging the events to Splunk in another format, you can inject and existing formatter, or your custom made.

Note. Sample is for TCP but similar construct exist for UDP.

var formatter = new MessageTemplateTextFormatter(
    "{Timestamp:HH:mm} [{Level}] ({ThreadId}) {Message}{NewLine}{Exception}",
    formatProvider: null);

var log = new LoggerConfiguration()
    .WriteTo.SplunkViaTcp(
        new SplunkTcpSinkConnectionInfo("127.0.0.1", 10001),
        formatter,
        //OPTIONALS (defaults shown)
        restrictedToMinimumLevel: LevelAlias.Minimum)
    .CreateLogger();

SplunkTcpSinkConnectionInfo

The SplunkTcpSinkConnectionInfo also defines other settings you can configure:

new SplunkTcpSinkConnectionInfo(host, port)
{
    MaxQueueSize = 10000
}