Can someone provide a work example for Splunk HEC using Java Spring Boot?

aa70627 — Tue, 20 Dec 2022 15:15:56 GMT

Can someone assist with providing a working example on how to use and send data to Splunk HTTP Event Collect (HEC) from a java Spring Boot application? Please provide settings and code used for pom.xml, log4j.xml and code example. We reviewed the example from http://dev.splunk.com/view/splunk-logging-java/SP-CAAAE7M and we're not sure if its applicable to Java spring boot since spring boot automatically loads up its own logger.

our POM file

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">;

    <modelVersion>4.0.0</modelVersion>
    <groupId>com.myco</groupId>
    <artifactId>javaapp-network</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>javaapp-network</name>
    <description></description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.1.RELEASE</version>
        <relativePath/> 
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
        <spring-cloud.version>Finchley.RC1</spring-cloud.version>
    </properties>

    <repositories>

            <repository>
            <id>spring-milestones</id>
            <name>Spring Milestones</name>
            <url>https://repo.spring.io/milestone</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>

            <repository>
            <id>spring-plugins</id>
            <name>Spring Plugins</name>
            <url>http://repo.spring.io/plugins-release/</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>

     </repositories>

    <dependencies>

        <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
        <version>2.3</version>
    </dependency>

        <dependency>
            <groupId>com.splunk.logging</groupId>
            <artifactId>splunk-library-javalogging</artifactId>
            <version>1.5.3</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-mongodb</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-rest</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-jersey</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.kafka</groupId>
            <artifactId>spring-kafka</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

our log4j2.xml

<Appenders>

    <Socket name="socket" host="server01.myco.com" port="8088">
        <PatternLayout pattern="%p: %m%n" charset="UTF-8"/>
    </Socket>

    <Http name="http-input"
          url="https://server01.myco.com:8088"
          token="C6D6D450-E8CD-4507-8C01-C070A7888924"
          host="server01.myco.com"
          index="javaapp"
          source="splunktest"
          sourcetype="log4j"
          middleware="HttpEventCollectorUnitTestMiddleware"
          batch_size_bytes="0"
          batch_size_count="0"
          batch_interval="0"
          disableCertificateValidation="true">
        <PatternLayout pattern="%m"/>
    </Http>

</Appenders>

<Loggers>
    <Root level="INFO">
    </Root>
    <Logger name="splunk.logger" level="info">
        <AppenderRef ref="socket"/>
    </Logger>

    <Logger name="splunk.log4j" level="info">
        <AppenderRef ref="http-input"/>
    </Logger>

</Loggers>

Re: Example for Splunk HEC using Java Spring Boot

nytins — Sat, 22 Dec 2018 16:22:28 GMT

@aa70627 Did u manage to find a solution?

Re: Example for Splunk HEC using Java Spring Boot

devadyuti — Fri, 04 Sep 2020 21:04:13 GMT

I have a working example at https://github.com/devadyuti/integration-repo/tree/master/spring-log4j2-splunk

Re: Example for Splunk HEC using Java Spring Boot

aa70627 — Mon, 12 Oct 2020 01:42:38 GMT

Thanks !!! Greatly appreciated.

Re: Example for Splunk HEC using Java Spring Boot

sindhuja — Tue, 20 Dec 2022 04:38:52 GMT

Hi ,

I have same example code which looks same but am facing issue

am unable to see logs in splunk .

do u have any idea

Re: Example for Splunk HEC using Java Spring Boot

aa70627 — Tue, 20 Dec 2022 15:10:58 GMT

@nytins yes. The one that is highlighted as answer helped me resolve the issue.

topic Re: Example for Splunk HEC using Java Spring Boot in Getting Data In

Can someone provide a work example for Splunk HEC using Java Spring Boot?

Re: Example for Splunk HEC using Java Spring Boot

Re: Example for Splunk HEC using Java Spring Boot

Re: Example for Splunk HEC using Java Spring Boot

Re: Example for Splunk HEC using Java Spring Boot

Re: Example for Splunk HEC using Java Spring Boot