How do I set up Splunk to receive logging from Serilog/.Net?

Question

I've tried to write a c# program that logs to splunk via serilog logger.

I've tried to set up splunk to listen for the logging.

All running on my local machine.

My guess would be that I have not configured Splunk correctly.

            Log.Logger = new LoggerConfiguration()
            .WriteTo
            .SplunkViaTcp(
                new Serilog.Sinks.Splunk.SplunkTcpSinkConnectionInfo("127.0.0.1", 19000)
                )
            .CreateLogger();

        while (true)
        {
            Log.Logger.Debug("Hello world");
            Thread.Sleep(1000);
        }

Splunk setup (Splunk is monitoring and showing windows events just fine): Data Inputs, Added 'TCP', 'set source type'=manual, 'source type'=log4net_xml

I've tried variations of 'source type' with no luck.

Any suggestions? Thanks, Anders

Above poc is from console application written in .net framwork 4.6.1 — Anders Juul, Nov 02 '17 at 10:23

score 0 · Answer 1 · answered Nov 02 '17 at 10:38

0

Have you tried setting a minimum level for logging? You writing a Debug message but the minimum level defaults to Information (see Docs) if none is specified. Does the following work?

Log.Logger = new LoggerConfiguration()
    .MinimumLevel.Debug()
    .WriteTo
    .SplunkViaTcp(
        new Serilog.Sinks.Splunk.SplunkTcpSinkConnectionInfo("127.0.0.1", 19000)
    )
    .CreateLogger();

answered Nov 02 '17 at 10:38

Gavin Sutherland

1,666
3
23
36

I had tried logging at level Error to prevent precisely that problem, but following your post, I tried your suggestion too. Neither produced anything in splunk. – Anders Juul Nov 02 '17 at 13:21
You could test to see if the issue is at the Splunk end by adding a Console logger too. If no messages get to your console then the problem could be elsewhere. – Gavin Sutherland Nov 02 '17 at 13:46

How do I set up Splunk to receive logging from Serilog/.Net?

1 Answers1