Note: The Splunk SDK for C# is in development and is not currently supported.

The Splunk Software Development Kit (SDK) for C# contains library code and examples designed to enable developers to build applications using Splunk.

Splunk is a search engine and analytic environment that uses a distributed map-reduce architecture to efficiently index, search, and process large time-varying data sets.

The Splunk product is popular with system administrators for aggregation and monitoring of IT machine data, security, compliance and a wide variety of other scenarios that share a requirement to efficiently index, search, analyze, and generate real-time notifications from large volumes of time series data.

The Splunk developer platform enables developers to take advantage of the same technology used by the Splunk product to build exciting new applications that are enabled by Splunk's unique capabilities.

Version 2.0 introduces new modern APIs that leverage the latest .NET platform advancements.

• Async - All APIs are 100% asynchronous supporting the new async/await features.
• All APIs follow .NET guidelines and abide by FxCop and StyleCop rules.
• Reactive Extensions - Splunk Enterprise query results implement IObservable, allowing usage with the .NET Reactive Extensions.
• Support for cross-platform development - The Splunk API client (Splunk.Client.dll) in the new version is a Portable Class Library.

Below is an example of a simple normal search:

using Splunk.Client;

var service = new Service(Scheme.Https, "localhost", 8089));

//login
await service.LoginAsync("admin", "changeme");

//create a job
var job = await service.StartJobAsync("search index=_internal | head 10");

//get the results
var searchResults = await job.GetSearchResultsAsync());

//loop through the results
foreach (var record in searchResults)
{
    Console.WriteLine(string.Format("{0:D8}: {1}", ++recordNumber, record));
}

.NET 4.5, PCL (Windows 8.1, Windows Phone 8.1, iOS (via Xamarin.iOS), Android (via Xamarin.Android)

*Note - Xamarin support is a work in progress

The Splunk SDK for C# version 2.0 is a rewrite of the existing SDK, and introduces completely new APIs.

Important: Applications built with Splunk SDK for C# version 1.x will not recompile using Splunk SDK for C# version 2.0.

Splunk SDK for C# version 2.0 includes a subset of the capability in version 1.0 of the SDK, and focuses on the most common scenarios that we have seen customers using. The major focus areas are search, search jobs, configuration, and modular inputs.

Following is a breakdown of the areas covered:

• Login
• Access control (users and passwords)
• Searches (normal, blocking, oneshot, and export)
• Jobs
• Reports ("saved searches" in Splunk Enterprise 5)
• Configuration and Config Properties
• Indexes
• Inputs (sending simple and streamed events to Splunk Enterprise)
• Applications
• Modular inputs

For detailed API coverage, see this coverage matrix.

We will publish guidance on how to migrate applications built using the Splunk SDK for C# 1.x to use the Splunk SDK for C# 2.0.

The Splunk SDK for C# contains library code and examples that show how to programmatically interact with Splunk for a variety of scenarios including searching, saved searches, data inputs, and many more, along with building complete applications.

The information in this Readme provides steps to get going quickly. In the future we plan to roll out more in-depth documentation.

Here's what you need to get going with the Splunk SDK for C# version 2.0.

If you haven't already installed Splunk Enterprise, download it at http://www.splunk.com/download. For more information about installing and running Splunk Enterprise and system requirements, see the Splunk Installation Manual.

• The Splunk SDK for C# supports development in Microsoft Visual Studio 2012 and later. Visual Studio downloads are available on the Visual Studio Downloads webpage.
• Support for Xamarin Studio and MonoDevelop is in progress.

Get the Splunk SDK for C#. Download the ZIP file and extract its contents.

If you are interested in contributing to the Splunk SDK for C#, you can get it from GitHub and clone the resources to your computer.

Before starting to develop custom software, you must first build the SDK. Once you've downloaded and extracted—or cloned—the SDK, do the following:

1. At the root level of the splunk-sdk-csharp-pcl directory, open the splunk-sdk-csharp-pcl.sln file in Visual Studio.
2. On the BUILD menu, click Build Solution.

This will build the SDK, the examples, and the unit tests.

The Splunk SDK for C# includes full unit tests which run using xunit. Examples are a work in progress.

The CHANGELOG.md file in the root of the repository contains a description of changes for each version of the SDK. You can also find it online at https://github.com/splunk/splunk-sdk-csharp/blob/master/CHANGELOG.md.

The master branch always represents a stable and released version of the SDK. You can read more about our branching model on our Wiki at https://github.com/splunk/splunk-sdk-csharp/wiki/Branching-Model.

If you need to know more:

• For all things developer with Splunk, your main resource is the Splunk Developer Portal.

• For more about the Splunk REST API, see the REST API Reference.

• For more about about Splunk in general, see Splunk>Docs.

Stay connected with other developers building on Splunk.

If you want to make a code contribution, go to the Open Source page for more information.

This product is currently in development and officially unsupported. We will be triaging any issues filed by the community however and addressing them as appropriate. Please file issues for any problems that you encounter.

You can reach the Dev Platform team at devinfo@splunk.com.

The Splunk SDK for C# is licensed under the Apache License 2.0. Details can be found in the LICENSE file.