AlanBarber / NLog.Targets.Splunk

A NLog target for Splunk Http Event Collector (HEC) Sender
Apache License 2.0
9 stars 24 forks source link

Timestamp accuracy #45

Closed hangy closed 3 years ago

hangy commented 3 years ago

Right now, the timestamp used to write to Splunk is created by the HttpEventCollectorEventInfo constructor with DateTime.UtcNow because of the overload used here https://github.com/AlanBarber/NLog.Targets.Splunk/blob/fa0ceb2a1008f888b55476008db76a53651f844b/src/NLog.Targets.Splunk/SplunkHttpEventCollector.cs#L250

NLog seems to provide the actual timestamp of the log event in LogEventInfo.TimeStamp: https://github.com/NLog/NLog/blob/v4.7.7/src/NLog/LogEventInfo.cs#L169 This can provide higher accuracy timestamps of the time source configured in NLog, and would result in the same timestamp logged in all sources.

Is there a specific reason why this not done right now? It can probably be changed by adding logEventInfo.TimeStamp as the first parameter to Send and checking that datetime is of the UTC kind in the HttpEventCollectorEventInfo ctor.