Updated

EonaCat.Logger/Managers/LogHelper.cs

@@ -7,8 +7,10 @@ using System.Text;
 using System.Threading.Tasks;
 using System.Xml.Linq;
 using EonaCat.Json;
+using EonaCat.Json.Linq;
 using EonaCat.Logger.Extensions;
 using EonaCat.Logger.GrayLog;
+using EonaCat.Logger.Splunk.Models;
 using EonaCat.Logger.Syslog;
 using Microsoft.Extensions.Logging;
 
@@ -136,9 +138,9 @@ namespace EonaCat.Logger.Managers
             logger.Log(logLevel, message);
         }
 
-        public static async Task SendToSplunkServersAsync(LoggerSettings settings, string jsonPayload, bool sendToSplunkServer)
+        public static async Task SendToSplunkServersAsync(LoggerSettings settings, SplunkPayload splunkPayload, bool sendToSplunkServer)
         {
-            if (settings == null || !sendToSplunkServer || string.IsNullOrWhiteSpace(jsonPayload))
+            if (settings == null || !sendToSplunkServer || splunkPayload == null)
                 return;
 
             if (settings.SplunkServers == null)
@@ -165,17 +167,11 @@ namespace EonaCat.Logger.Managers
                 {
                     try
                     {
-                        using (var httpClient = new HttpClient(splunkServer.SplunkClientHandler))
+                        var response = await splunkServer.SendAsync(splunkPayload);
+
+                        if (!response.IsSuccessStatusCode)
                         {
-                            var content = new StringContent(jsonPayload, Encoding.UTF8, "application/json");
+                            OnException?.Invoke(null, new ErrorMessage { Message = $"Failed to send log to Splunk '{splunkServer.SplunkHecUrl}'. Status code: {response.StatusCode}" });
-                            httpClient.DefaultRequestHeaders.Add("Authorization", $"Splunk {splunkServer.SplunkHecToken}");
-
-                            var response = await httpClient.PostAsync(splunkServer.SplunkHecUrl, content);
-
-                            if (!response.IsSuccessStatusCode)
-                            {
-                                OnException?.Invoke(null, new ErrorMessage { Message = $"Failed to send log to Splunk '{splunkServer.SplunkHecUrl}'. Status code: {response.StatusCode}" });
-                            }
                         }
                     }
                     catch (Exception exception)
@@ -191,12 +187,14 @@ namespace EonaCat.Logger.Managers
             if (settings == null || !sendToSplunkServer || string.IsNullOrWhiteSpace(message))
                 return;
 
-            var jsonPayload = JsonHelper.ToJson(new
+            var splunkPayload = new SplunkPayload
             {
-                @event = message,
+                Host = Environment.MachineName,
-                sourcetype = logType
+                EventData = message,
-            });
+                SourceType = logType
-            await SendToSplunkServersAsync(settings, jsonPayload, sendToSplunkServer);
+            };
+
+            await SendToSplunkServersAsync(settings, splunkPayload, sendToSplunkServer);
         }
 
         internal static async Task SendToGrayLogServersAsync(LoggerSettings settings, string message, ELogType logLevel, string facility, string source, bool sendToGrayLogServer, string version = "1.1")

EonaCat.Logger/Splunk/Models/SplunkPayload.cs

@@ -0,0 +1,13 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+
+namespace EonaCat.Logger.Splunk.Models
+{
+    public class SplunkPayload
+    {
+        public string EventData { get; set; }
+        public string SourceType { get; set; }
+        public string Host { get; set; }
+    }
+}

EonaCat.Logger/Splunk/SplunkServer.cs

@@ -1,5 +1,12 @@
-using System;
+using EonaCat.Json;
+using EonaCat.Logger.Splunk.Models;
+using System;
+using System.Net;
 using System.Net.Http;
+using System.Net.Security;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
 
 namespace EonaCat.Logger.SplunkServer
 {
@@ -49,9 +56,10 @@ namespace EonaCat.Logger.SplunkServer
         }
 
         public HttpClientHandler SplunkClientHandler { get; internal set; }
+        public HttpClient HttpClient { get; private set; }
 
         internal readonly object SendLock = new object();
-        private string _splunkHecUrl = "https://127.0.0.1:8088/services/collector";
+        private string _splunkHecUrl = "https://127.0.0.1:8088/services/collector/event";
         private string _splunkHecToken = "splunk-hec-token";
 
         public bool HasHecToken => !string.IsNullOrWhiteSpace(SplunkHecToken) && SplunkHecToken != "splunk-hec-token";
@@ -78,6 +86,16 @@ namespace EonaCat.Logger.SplunkServer
             }
 
             SplunkClientHandler = httpClientHandler;
+            CreateHttpClient();
+        }
+
+        private void CreateHttpClient()
+        {
+            HttpClient = new HttpClient(SplunkClientHandler);
+            HttpClient.BaseAddress = new Uri(SplunkHecUrl);
+
+            // Add the HEC token to the request headers for authorization
+            HttpClient.DefaultRequestHeaders.Add("Authorization", $"Splunk {SplunkHecToken}");
         }
 
         /// <summary>
@@ -90,7 +108,41 @@ namespace EonaCat.Logger.SplunkServer
             {
                 ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true,
             };
+            
             SplunkClientHandler = clientHandler;
+            CreateHttpClient();
+        }
+
+        public async Task<HttpResponseMessage> SendAsync(SplunkPayload splunkPayload)
+        {
+            if (splunkPayload == null)
+            {
+                return null;
+            }
+
+            // Create an event object with the required fields
+            var eventObject = new
+            {
+                @event = splunkPayload.EventData,
+                sourcetype = splunkPayload.SourceType,
+                host = splunkPayload.Host
+            };
+
+            // Serialize the event object to JSON
+            string eventJson = JsonHelper.ToJson(eventObject);
+
+            if (!HasHecToken)
+            {
+                CreateHttpClient();
+            }
+
+            // Create an HTTP content with the event data
+            var content = new StringContent(eventJson, Encoding.UTF8, "application/json");
+
+            // Send the event to Splunk
+            HttpResponseMessage response = await HttpClient.PostAsync("/services/collector/event", content);
+
+            return response;
         }
     }
 }