Send custom Log Field through NLog

Help
1

Hello everyone,

I’ve been experimenting with Add Log Fields recently in order to make Splunk researches easier. The connection between Splunk and Robots is set up but I’m lacking some information in the logs.

For example, I want to associate every step of a process with other info regarding the process (e.g. AccountName, etc.). This way, one could search for the “AccountName” field and look what was done with it.

The thing I want to avoid is to write the information in the Log Message itself through a variable. I want that variable to attach to all the Logs inside of the process. “Add Log Fields” before the process and “Delete Log Fields” when the process is done works fine in Orchestrator; the Logs are indeed associated with their respective AccountName through each run of the loop.

The problem is the NLog layout. Whenever I try to pass ${all-event-properties} with the Splunk target in the web.config, the Logs that are picked up by Splunk are a mess… Mostly because of the rawMessage that is formatted differently than the other properties, for some reason. The {all-events-properties} is key=value, … Inside that, the rawMessage is {“key”:“value”,…}. Why this would make any sense, I don’t know.

image

Using ${event-property:item=AccountName} defeats the purpose as the parameter name will most likely change from Process to Process. Using generic names (e.g. TransactionParameter1) shared by all the Processes won’t work either.

How would you dynamically add those “custom log fields” (add log fields activity) through NLog ?

EDIT: I thought about using rawMessage only but it’s lacking some info and the formatting makes it hard to work with in Splunk.

Thanks in advance,

MP

2

any luck on this ?