Var service = new Splunk.Service(svcArgs) This.Log('Search String: ' + searchString, null) Var searchString = string.Format('search source=*', source, searchQuery) Source = source.ToLower().Replace(' ', string.Empty) Public XmlDocument GetXmlFromSplunk(string host, int port, string userName, string password, string searchKey, string searchQuery) SearchQuery =”sourcetype=xml | sort _time | tail 1” Dashboard snapshot of service information.Dashboard snapshot of system information.The custom web application uses Splunk SDK to connect to the Splunk central receiver host, queries the required information and displays it on the dashboard UI.

2: Splunk search application (web) Custom Web Application These events can be queried using the Splunk web client or any custom application using the Splunk SDK. The Splunk Central Receiver is configured on a server to receive the information on a particular port and logs them as Splunk events. The forwarder will monitor a folder (configured during installation) and filters the files based on the filters (like *.Log, *.Xml, *.txt etc if any), then forwards the files to the Splunk Central Receiver (to a specified port). The Splunk Universal Forwarder is installed on all the environments to be monitored. It logs the collected information as XML to a location (file system) which is monitored by the Splunk forwarder. The Agent is a PowerShell script that runs (as a scheduled job) on an environment and collects the information like services status, assembly versions, data base status and machine configuration. 1: Data Flow from App Server/Workflow server to Splunk web UI/Custom Dashboard App Agent The main components of this implementation are (refer to Fig. So we developed an ASP.Net web dashboard application, leveraging the Splunk (SDK) platform, to monitor REST Services status, Database connectivity, App Settings, Environment/Server Information for better troubleshooting. Custom Dashboard Using SplunkĪpart from the general application error logs, system logs and event viewer data, we also need to monitor application-specific information. This helps to remove admin dependency by providing real-time and historical data, all accessible over the network. With Splunk, we are able to pull different servers’ data in a single view and identify which server caused the issue. If an application error occurs in a cluster environment with multiple servers, we are not immediately sure at which node the error occurred - so developers/testers have to depend on build engineers to login to each server remotely to identify and validate the event viewer/service logs and troubleshoot issues on a trial-and-error basis. Splunk also includes numerous useful analyses out of the box to help understand the reoccurrence/pattern of the issues.

It pulls the data from the different servers and displays it in a thin web browser client. We have configured Splunk to monitor service logs (hard disk-based text files), event viewer data, etc. The applications are quite complex, with many subsystems/REST services that depend on each other. Our Usage of Splunkįor enterprise customers, we have a private cloud setup to manage various environments/servers. Splunk captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations. Moreover, the solution needs a browser-based interface as opposed to providing administrative privilege, remote access to the server. Thus, there is a need to integrate different sources of data for a consolidated view – to help improve developers/testers’ productivity and quickly resolve application/environment issues. As the number of servers increases, the challenges to troubleshoot or investigate any application failure increases multifold. A large, enterprise-class application involves many servers.

Splunk dashboard