Send Robot Logs To Splunk

How to send Robot logs to Splunk on Automation Suite deployment Orchestrator?

For Orchestrator deployed on Automation Suite, to update NLog configuration, use


  1. NLog.Targets.Splunk.3.0.0.nupkg (
  2. Build nlog.custom.config with below format:


"NLog": {

"autoReload": false,

"throwConfigExceptions": false,

"internalLogLevel": "Trace",

"internalLogToConsole": true,

"default-wrapper": {

"type": "UiPrettyExceptionWrapper"


"extensions": [

{ "assemblyFile": "/var/orchestrator/plugins/nlog/NLog.Targets.Splunk.dll" },

{ "assemblyFile": "/opt/app-root/app/UiPath.Orchestrator.Logs.DatabaseBulk.NLogTarget.dll" }


"targets": {

"Splunk": {

"type": "BufferingWrapper",

"flushTimeout": 5000,

"target": {

"type": "SplunkHttpEventCollector",

"serverUrl": "http://<your_SPLUNK_instance>:8088",

"token": "<your splunk token>",

"channel": "",

"source": "${logger}",

"sourceType": "_json",

"index": "<your splunk index>",

"retriesOnError": "0",

"batchSizeBytes": "0",

"batchSizeCount": "0",

"includeEventProperties": "true",

"includePositionalParameters": "true",

"includeMdlc": "true",

"maxConnectionsPerServer": "10",

"ignoreSslErrors": "false",

"useProxy": "false",

"proxyUrl": "",

"proxyUser": "",

"proxyPassword": ""




"rules": {

"20_Robot_Primary": {

"writeTo": "Splunk,database"





Configuration Steps:

  1. Extract from NLog.Targets.Splunk.3.0.0.nupkg the NLog.Targets.Splunk.dll corresponding to netcoreapp3.1 (NLog.Targets.Splunk.3.0.0\lib\netcoreapp3.1\NLog.Targets.Splunk.dll)
  2. Copy NLog.Targets.Splunk.dll to an empty folder from the Automation Suite Linux server
  3. On the same Linux server create the nlog.custom.config following the above example
  4. On the same Linux machine go to /opt/UiPathAutomationSuite/<version>/installer/Tools
  5. Execute: ./ -n /path/to/dll/FOLDER -l /path/to/nlog.custom.config
  6. The above will update orchestrator-customconfig configmap and restart the Orchestrator deployment
  7. Check is the configmap contains the exact configuration from nlog.custom.config by running command kubectl -n uipath describe configmaps orchestrator-customconfig
  1. If all is configured with the correct information and the network connectivity between Automation Suite and the Splunk instance is also set, verify the Robot logs in Splunk. If not, in the configmap set the internalLogLevel to trace, and check the Orchestrator container logs for more information:
  • kubectl -n uipath logs orchestrator-xxxxxx-yyyyy -c orchestrator.