SplunkLayout

A specialized layout that renders each log event as the Splunk JSON format expected by the Splunk HTTP Event Collector (HEC).

SplunkLayout renders the complete HEC event, including the outer time, host, source, sourcetype, index, and nested event fields.

Platforms Supported: All - Requires nuget-package NLog.Targets.Network

<target name="jsonFile" xsi:type="File" fileName="splunk-file.json" >
      <layout xsi:type="SplunkLayout" includeEventProperties="Boolean" excludeProperties="Comma-separated list (string)">
            <SplunkField name="threadid" layout="${threadid}" />
            <SplunkField name="messagetemplate" layout="${message:raw=true}" />  
       </layout>
</target>

• SplunkHostName - Splunk Message Host-field. Default = ${hostname}

• SplunkSourceName - Splunk Message Source-field. Default = ${processname}

• SplunkSourceType - Splunk Message SourceType-field. Use _json to enable automatic extraction of fields from the JSON event object. Default = _json

• SplunkIndex - Splunk Message Index-field. The HEC token must have write-access to this index. No value means using HEC token's default index. Default = null

• IncludeEventProperties - Include all properties from the log events. Default = true.

• IncludeScopeProperties - Include all scope-properties from the ScopeContext. Default = false.

• ExcludeEmptyProperties - Exclude null/empty properties. Default = false.

• ExcludeProperties - Comma separated string with names which properties to exclude.

• SplunkField

  • name - Required. The name of the JSON-key
  • layout - The layout for the JSON-value (Can be a nested JsonLayout)

SplunkLayout can be used with an HTTP target to send events to the Splunk HEC /services/collector/event endpoint using newline-delimited JSON (NDJSON).

The HTTP target must provide the following HTTP header: Authorization: Splunk <hec-token>