How To Configure Orchestrator To Write Logs To Splunk

[system]

How to configure Orchestrator to write logs to Splunk

Setup Instructions

1. From the Splunk homepage select 'Add Data'

2. Select 'Monitor'

3. Choose the source type, which will be TCP/UDP. Choose UDP and specify the port you would like to use for the listener. Click 'Next'

4. Choose the source type (We chose syslog as the category), and the additional options regarding categorization/allocation of the data (Hostname/IP, Index to be logged to). Click 'Review'

5. Review options and Click 'Submit'

6. Open the OrchestratorDll.Config file located in the Orchestrator Web folder.

7. Navigate to <Targets> below/inside the <Nlog section, add a new target line
<target name="Splunk" xsi:type="SplunkHttpEventCollector" serverUrl="<connect string to your splunk api>" token="<your token, if you have one>" channel="" retriesOnError="0" batchSizeBytes="2048" batchSizeCount="20" includeEventProperties="true" includeMdlc="false" includePositionalParameters="false" MaxConnectionsPerServer="10" IgnoreSslErrors="true">
<contextproperty name="host" layout="${machinename}" />
<contextproperty name="threadid" layout="${threadid}" />
<contextproperty name="logger" layout="${logger}" />
</target>

Add Splunk to the end of Line 115
<logger name="Robot.*" ruleName="primaryRobotLogsTarget" final="true" writeTo="database,Splunk" />

Add splunk to the end of Line 149
<add key="Logs.RobotLogs.ReadTarget" value="database,Splunk" />


8. Navigate to <Rules> find the <logger> with Robot.* and add your target name (my example is 'insightsRobotLogs') to the list in writeTo

NLog Network Target
More information about NLog network targeting options can be found here:
https://github.com/NLog/NLog/wiki/Network-target



Example of Logging