在c#中创建与splunk兼容的日志文件
我正在尝试创建一个 splunk 将读入并索引的日志文件。使用 Splunk 的 通用信息模型，我已将日志格式化为如下所示：
2011-30-07 12:30:37 name="Name" event_id=00001 src_ip=192.168.0.1 src_port=59176
2011-30-07 12:31:35 name="Name" event_id=00001 src_ip=192.168.0.1 src_port=59176
2011-30-07 12:32:02 name="Name" event_id=00001 src_ip=192.168.0.1 src_port=59176
etc...
但是，当我将日志文件加载到 Splunk 中时，它会将所有内容作为一个日志读取，并且不会将它们分开！为了在 c# 中编写日志，我使用了 StreamWriter，最后我打印了 \r\n，但我也尝试过 Environment.NewLine （其中显然做了同样的事情）。
这些似乎都不起作用，因此不单独索引！有谁有 Splunk 的经验并知道为什么会这样吗？
I'm trying to create a log file that splunk will read in and index. Using Splunk's Common Information Model, I have formatted my logs like so:
2011-30-07 12:30:37 name="Name" event_id=00001 src_ip=192.168.0.1 src_port=59176
2011-30-07 12:31:35 name="Name" event_id=00001 src_ip=192.168.0.1 src_port=59176
2011-30-07 12:32:02 name="Name" event_id=00001 src_ip=192.168.0.1 src_port=59176
etc...
However, when I load a log file into Splunk it reads this all as one log and doesn't split them up! To write the log out in c# I'm using a StreamWriter and at the end I was printing \r\n, but I've also tried Environment.NewLine (which apparently does the same thing).
Neither of these seem to work and therefore do not index separately! Does anyone have experience with Splunk and know why this might be?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我从来没有使用过 splunk，所以我真的不知道我是否正确。
但是，如果我看一下规格（您提供的链接），它们似乎使用双引号，而在您的示例中您输入了单引号。那么也许您所要做的就是将
name='Name'替换为name="Name"？另一点可能是您必须为标签
vendor或product提供一些信息才能进行一些拆分？但这都是推测，因为我真的不知道这个工具。
更新
在深入研究他们的网站后，您可以看到他们的比较表 您还可以获得免费版本的基本支持。因此，也许只需您喜欢的支持访问并从该工具的创建者那里获得答案。他们绝对应该知道为什么你的消息不起作用。
I never used splunk, so i really don't know if i'm correct.
But if i take a look at the specs (link you provided) their seem to use double quotes and in your example you entered single quotes. So maybe all you have to do is replace
name='Name'byname="Name"?Another point could be that you must give some informations for the tags
vendororproductto get some split up?But that's all speculative, cause i really don't know the tool.
Update
After a little digging into their site you can see at their comparison sheet you can get also basic support for the free version. So maybe just take the support access you like and get an answer from the creators of the tool. Their should definitely know why your messages are not working.
感谢奥利弗让我成功了一半。我联系了 Splunk 的一位开发支持人员，虽然他们没有看到答案，但我自己找到了答案。
虽然 Splunk 非常擅长使用日志文件计算日期，但如果它无法识别日期格式，它将不会解析它，因此将整个字符串作为一个事件放入！问题是日期格式错误...即 Ydm，而它应该是 Ymd！
Thanks to Oliver for getting me half way there. I contacted one of the dev support people at Splunk and while they didn't see the answer, I figured it out for myself.
While Splunk is very good at working out dates with log files, if it can't recognise the date format it will not parse it and therefore put the whole string in as an event! The problem was that the date was in the wrong format... i.e Y-d-m when it should have been Y-m-d!
只需使用 log4net，并使用 syslog 模块即可。
将 syslog 指向 splunk 上的 udp 侦听器。
然后很快！效果很好！
（我们让它工作得很好，但正在抛弃 splunk，因为它太贵了。三思而后行！）
Just use log4net, and use the syslog module.
Point syslog at a udp listener on splunk.
And then presto! Works great!
(We have it working perfectly, but are dumping splunk 'cause it is toooo expensive. Look before you leap!)