topic Re: Unable to get logs in splunk from mulesoft in Getting Data In

Unable to get logs in splunk from mulesoft

fhatrick — Wed, 23 Apr 2025 22:26:15 GMT

Hi, I have created a new token and index in splunk for my mulesoft project.

These are the configurations I have done in mulesoft to get the splunk logs.Despite this I am unable to see any logs in the dashboard when i search like index="indexname".

LOG4J2.XML FILE CHANGES

<Configuration status="INFO" name="cloudhub"

packages="com.mulesoft.ch.logging.appender,com.splunk.logging,org.apache.l

ogging.log4j">

<RollingFile "Rolling file details here"

</RollingFile>

<SplunkHttp name="Splunk"

url="localhost url"

token="token" index="indexname"

batch_size_count="10" disableCertificateValidation="true">

<PatternLayout

pattern="%-5p %d [%t] [processor: %X{processorPath}; event: %X{correlationId}] %c: %m%n" />

</SplunkHttp>

<Log4J2CloudhubLogAppender name="CloudHub"

addressProvider="com.mulesoft.ch.logging.DefaultAggregatorAddressProvider"

applicationContext="com.mulesoft.ch.logging.DefaultApplicationContext"

appendRetryIntervalMs="${sys:logging.appendRetryInterval}"

appendMaxAttempts="${sys:logging.appendMaxAttempts}"

batchSendIntervalMs="${sys:logging.batchSendInterval}"

batchMaxRecords="${sys:logging.batchMaxRecords}"

memBufferMaxSize="${sys:logging.memBufferMaxSize}"

journalMaxWriteBatchSize="${sys:logging.journalMaxBatchSize}"

journalMaxFileSize="${sys:logging.journalMaxFileSize}"

clientMaxPacketSize="${sys:logging.clientMaxPacketSize}"

clientConnectTimeoutMs="${sys:logging.clientConnectTimeout}"

clientSocketTimeoutMs="${sys:logging.clientSocketTimeout}"

serverAddressPollIntervalMs="${sys:logging.serverAddressPollInterval}"

serverHeartbeatSendIntervalMs="${sys:logging.serverHeartbeatSendIntervalMs}"

statisticsPrintIntervalMs="${sys:logging.statisticsPrintIntervalMs}">

</Log4J2CloudhubLogAppender>

</Appenders>

</AsyncRoot>

</AsyncLogger>

</Loggers>

</Configuration>

POM.XML FILE CHANGES

<id>splunk-artifactory</id>

<name>Splunk Releases</name>

<url>https://splunk.jfrog.io/splunk/ext-releases-local</url>

</repository>

<groupId>com.splunk.logging</groupId>

<artifactId>splunk-library-javalogging</artifactId>

</dependency>

<groupId>org.apache.logging.log4j</groupId>

</dependency>

<groupId>org.apache.logging.log4j</groupId>

</dependency>

Please let me know if i am missing out on any configuration since i believe i am pretty much following what's in the mule website and other articles.

Re: Unable to get logs in splunk from mulesoft

richgalloway — Thu, 24 Apr 2025 00:13:37 GMT

Have you enabled receiving of data in Splunk? Go to Settings->"Forwarding and Receiving" to turn on receiving.

Does "localhost url" include the port number (9997 by default)?

Do your firewalls allow connections between Mulesoft and Splunk?

Re: Unable to get logs in splunk from mulesoft

livehybrid — Thu, 24 Apr 2025 07:55:19 GMT

Hi @fhatrick

Check the following points to troubleshoot why logs are not appearing in Splunk using the HEC-based SplunkHTTP log4j logging options:

Splunk HEC URL and Token

Ensure the url in your config points to your Splunk HTTP Event Collector (HEC) endpoint, not localhost unless Splunk is running on the same host as MuleSoft.
Example: url="https://<splunk-server>:8088"

The token value must match exactly the HEC token configured in Splunk.

HEC Configuration in Splunk

Confirm that HEC is enabled in Splunk (Settings > Data Inputs > HTTP Event Collector).
The token is enabled and assigned to the correct index (indexname).

Index Existence and Permissions

Verify the index (indexname) exists in Splunk and your user has permission to search it.

Network Connectivity

Ensure the MuleSoft server can reach the Splunk HEC endpoint (no firewall or network issues) - use something like netcat to check this (nc -vz -w1 yourServer 8088)

Testing HEC Directly

Test HEC by sending a sample event using:

curl -k https://<splunk-server>:8088/services/collector/event \ -H "Authorization: Splunk <token>" \ -d '{"event":"test event", "index":"indexname"}'

If this event appears in Splunk, the HEC and index are working.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Unable to get logs in splunk from mulesoft

fhatrick — Thu, 24 Apr 2025 08:40:31 GMT

My url is "http://127.0.0.1:8000" in log4j2 and localhost is running on same port. Whereas the listener is 8081 port. Do all of these have to be same? Am i missing out anywhere?

Re: Unable to get logs in splunk from mulesoft

fhatrick — Thu, 24 Apr 2025 09:05:47 GMT

My url is "http://127.0.0.1:8000" in log4j2 and localhost(splunk) is running on same port. Whereas the listener is 8081 port.

Earlier the url was "http://127.0.0.1:8088" in log4j2 localhost(splunk) is running on port 8000.Whereas the listener is 8081 port.

Re: Unable to get logs in splunk from mulesoft

livehybrid — Thu, 24 Apr 2025 10:00:03 GMT

Hi @fhatrick

Splunk HEC typically listens on port 8088 - Have you changed this default port to something else? Have you enabled SSL for HEC? If not you will need to use http:// instead of https://

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Unable to get logs in splunk from mulesoft

fhatrick — Thu, 24 Apr 2025 10:04:18 GMT

The url is "http://127.0.0.1:8088" in log4j2 and localhost(splunk) is running on port 8000.Whereas the project listener is 8081 port.

Yes i have enabled ssl.

Most documentation have the same setting so i followed the same ,yet cannot see the logs.