Serilog.Sinks.Splunk

A Serilog sink that writes events to the Splunk. Supports .NET 8+, .NET 9, .NET 10, and platforms compatible with the .NET Platform Standard netstandard2.0, netstandard2.1.

Package - Serilog.Sinks.Splunk

Getting started

To get started install the Serilog.Sinks.Splunk package:

PM> Install-Package Serilog.Sinks.Splunk

OR

$ dotnet add package Serilog.Sinks.Splunk

If using the TCP or UDP sinks install the following packages

• TCP: Serilog.Sinks.Splunk.TCP
• UDP: Serilog.Sinks.Splunk.UDP

To start using the Splunk Event Collector (Splunk 6.3 and above), logging can be setup as follows.

var log = new LoggerConfiguration()
    .WriteTo.EventCollector("https://mysplunk:8088/services/collector/event", "myeventcollectortoken")
    .CreateLogger();

If using appsettings.json for configuration the following example illustrates using the Event Collector and Console sinks.

{
    "Serilog": {
        "Using": ["Serilog.Sinks.Console", "Serilog.Sinks.Splunk"],
        "MinimumLevel": "Information",
        "WriteTo": [{
                "Name": "Console"
            },
            {
                "Name": "EventCollector",
                "Args": {
                    "splunkHost": "http://splunk:8088",
                    "uriPath": "services/collector/event",
                    "eventCollectorToken": "00112233-4455-6677-8899-AABBCCDDEEFF"
                }
            }
        ],
        "Properties": {
            "Application": "Serilog Splunk Console Sample"
        }
    }
}

Automatic host name

Use the includeHost option to automatically set the Splunk host metadata field to the machine name. This is opt-in and defaults to false.

var log = new LoggerConfiguration()
    .WriteTo.EventCollector(
        "https://mysplunk:8088",
        "myeventcollectortoken",
        includeHost: true)
    .CreateLogger();

Or via appsettings.json:

{
    "Name": "EventCollector",
    "Args": {
        "splunkHost": "http://splunk:8088",
        "eventCollectorToken": "00112233-4455-6677-8899-AABBCCDDEEFF",
        "includeHost": true
    }
}

If host is explicitly set, it takes precedence over includeHost.

More information about Serilog is available on the wiki.

Serilog is copyright © 2013-2026 Serilog Contributors - Provided under the Apache License, Version 2.0. Needle and thread logo a derivative of work by Kenneth Appiah.