Splunk SDK for CSharp now in Public Preview

Newest member of the Splunk’s SDK family – CSharp was finally released to the public last week.

Splunk SDK for CSharp is now available for download. The SDK enables all the basic use cases, some of which are listed below:

  • Connect to Splunk
  • Get data out from Splunk by running the blocking and asynchronous searches
  • Export data from Splunk using the /export endpoint
  • Write data into Splunk
  • Manage Splunk objects
  • and more …

Learn more and find out how to get started at Splunk SDK for CSharp. Download the SDK and let us know what you think at DevInfo.

Let’s take a look at some sample code …

Connect to Splunk

// Define the context of the Splunk service
ServiceArgs svcArgs = new ServiceArgs();
svcArgs.Host = "localhost";
svcArgs.Port = 8089;

// Create a Service instance and log in 
Service service = new Service(svcArgs);
service = service.Login("admin", "changeme");

List Splunk objects, e.g. list of apps installed on Splunk

foreach (var app in service.GetApplications().Values)
    // Write a seperator between the name and the description of an app.
    Console.WriteLine(Enumerable.Repeat('-', app.Name.Length).ToArray());


Run a search and display results

var jobs = service.GetJobs();
var job = jobs.Create("search index=_internal | head 10");
while (!job.IsDone) 

var outArgs = new Args
    { "output_mode", "json" },

using (var stream = job.Results(outArgs))
    using (var rr = new ResultsReaderJson(stream))
        foreach (var map in rr)
            foreach (string key in map.Keys)
                System.Console.WriteLine("   " + key + " -> " + map[key]);

Write events into Splunk

var args = new Args 
    { "source", "splunk-sdk-tests" },
    { "sourcetype", "splunk-sdk-test-event" }

Receiver receiver = new Receiver(service);

// Submit to default index using the simple receiver endpoint
receiver.Submit(args, "Hello World from C# SDK!");

Post a Comment

Your email is never published nor shared. Required fields are marked *


By clicking "Submit" button below, I hereby certify that I am not (a) a citizen or permanent resident of any country on which the United States has embargoed goods, technology and/or services (e.g., Cuba, Iran, North Korea, Sudan, Syria, or Crimea), and (b) on any of the relevant U.S. Government Lists of prohibited or restricted persons, including but not limited to the Treasury Department's List of Specially Designated Nationals, and the Commerce Department's List of Denied Persons or Entity List, and that my use of Splunk products and services is in compliance with the applicable U.S. export control and economic sanctions laws and regulations. For further information on the export controls and sanctions laws see, http://www.bis.doc.gov/index.htm and http://www.treasury.gov/about/organizational-structure/offices/Pages/Office-of-Foreign-Assets-Control.aspx.