log.cfg to handle custom splunk app logs

coreyCLI — Tue, 26 Apr 2022 12:58:05 GMT

We built a custom app and deployed it in splunk. It is writing logs in splunk/var/log/appname/appname.log. I would like to find a way handle the logs natively within splunk, possibly using log.cfg to roll the log at a certain size as well as retention. I added a stanza to log.cfg in an attempt to manage this log but splunk doesnt appear to care about the added configs. Anyone use this file in such a way? Is it even possible? Below is a snippet of the config I added to log.cfg for the app.

appender.appname=RollingFileAppender
appender.appname.fileName=${SPLUNK_HOME}/var/log/appname/appname.log
appender.appname.maxFileSize=25000000 # default: 25MB (specified in bytes).
appender.appname.maxBackupIndex=5
appender.appname.layout=PatternLayout
appender.appname.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n

topic log.cfg to handle custom splunk app logs in Splunk Dev

log.cfg to handle custom splunk app logs