Why cant I see my Splunk logs?

goldsilver12 — Mon, 31 Jul 2023 21:00:43 GMT

I can't see my logs, Stack: Spring boot , Maven

Here is my pom file:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
   <modelVersion>4.0.0</modelVersion>
   <parent>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-parent</artifactId>
      <version>3.0.2</version>
      <relativePath/> <!-- lookup parent from repository -->
   </parent>
   <groupId>com.example</groupId>
   <artifactId>SpringBootCRUDWithSplunkIntegration</artifactId>
   <version>0.0.1-SNAPSHOT</version>
   <name>SpringBootCRUDWithSplunkIntegration</name>
   <description>SpringBootCRUDWithSplunkIntegration</description>
   <properties>
      <java.version>17</java.version>
   </properties>

   <repositories>
      <repository>
         <id>splunk-artifactory</id>
         <name>Splunk Releases</name>
         <url>https://splunk.jfrog.io/splunk/ext-releases-local</url>
      </repository>
   </repositories>
   <dependencies>
      <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-data-jpa</artifactId>
      </dependency>
      <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-web</artifactId>
         <exclusions>
            <exclusion>
               <groupId>org.springframework.boot</groupId>
               <artifactId>spring-boot-starter-logging</artifactId>
            </exclusion>
         </exclusions>
      </dependency>

      <!-- https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-log4j -->
      <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-log4j2</artifactId>
      </dependency>
      <!-- https://mvnrepository.com/artifact/com.splunk.logging/splunk-library-javalogging -->
      <dependency>
         <groupId>com.splunk.logging</groupId>
         <artifactId>splunk-library-javalogging</artifactId>
         <version>1.8.0</version>
         <scope>runtime</scope>
      </dependency>

      <dependency>
         <groupId>org.postgresql</groupId>
         <artifactId>postgresql</artifactId>
         <scope>runtime</scope>
      </dependency>
      <!-- https://mvnrepository.com/artifact/org.umlg/sqlg-postgres-dialect -->
      <dependency>
         <groupId>org.umlg</groupId>
         <artifactId>sqlg-postgres-dialect</artifactId>
         <version>1.3.2</version>
      </dependency>
      <dependency>
         <groupId>org.projectlombok</groupId>
         <artifactId>lombok</artifactId>
         <optional>true</optional>
      </dependency>
      <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-test</artifactId>
         <scope>test</scope>
      </dependency>
      <dependency>
         <groupId>log4j</groupId>
         <artifactId>log4j</artifactId>
         <version>1.2.12</version>
      </dependency>
   </dependencies>

   <build>
      <plugins>
         <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
            <configuration>
               <excludes>
                  <exclude>
                     <groupId>org.projectlombok</groupId>
                     <artifactId>lombok</artifactId>
                  </exclude>
               </excludes>
            </configuration>
         </plugin>
      </plugins>
   </build>

</project>

Here is my log4j.xml

<?xml version="1.0" encoding="UTF-8"?>
<Configuration>
    <Appenders>
        <Console name="console" target="SYSTEM_OUT">
            <PatternLayout
                    pattern="%style{%d{ISO8601}} %highlight{%-5level }[%style{%t}{bright,blue}] %style{%C{10}}{bright,yellow}: %msg%n%throwable" />
        </Console>
        <SplunkHttp
                name="splunkhttp"
                url="http://127.0.0.1:8088"
                token="c7d19018-8e86-4c22-ace8-00903bb92845"
                host="localhost"
                index="spring_dev"
                type="raw"
                source="source name"
                sourcetype="log4j"
                messageFormat="text"
                disableCertificateValidation="true">
            <PatternLayout pattern="%m" />
        </SplunkHttp>

    </Appenders>

    <Loggers>
        <Root level="info">
            <AppenderRef ref="console" />
            <AppenderRef ref="splunkhttp" />
        </Root>
    </Loggers>
</Configuration>

Can anybody help with that issue, I've tried everything literary

Re: I have an issue with slung logs

PickleRick — Mon, 31 Jul 2023 20:49:27 GMT

If you tried "everything", you must have tried dumping the traffic from the (loopback) interface with tcpdump. What does it show?

Re: Why cant I see my Splunk logs?

goldsilver12 — Mon, 31 Jul 2023 21:08:42 GMT

I'm a Windows user so I didn't try that. Do you think that the problem is in sending packages?

Re: I have an issue with slung logs

goldsilver12 — Mon, 31 Jul 2023 21:10:53 GMT

I'm a Windows user so I didn't try that. Do you think that the problem is in sending packets?

Re: I have an issue with slung logs

goldsilver12 — Mon, 31 Jul 2023 21:30:12 GMT

Re: I have an issue with slung logs

goldsilver12 — Mon, 31 Jul 2023 21:34:39 GMT

Re: Why cant I see my Splunk logs?

PickleRick — Tue, 01 Aug 2023 07:44:16 GMT

I dunno. Since HEC works on port 8088 (and your log4j configuration seems to be pointed on that port properly) limit your network dump to port 8088 and see if there is any traffic there. Does the TCP session get properly initialized, processed and closed? If so, check the HTTP transaction that's going on inside that session - do you get the proper HTTP POST request? Is it received properly and responded with a normal 200 OK code?

topic Re: I have an issue with slung logs in Splunk Enterprise

Why cant I see my Splunk logs?

Re: I have an issue with slung logs

Re: Why cant I see my Splunk logs?

Re: I have an issue with slung logs

Re: I have an issue with slung logs

Re: I have an issue with slung logs

Re: Why cant I see my Splunk logs?