topic Re: Why is WebLogic server.out parsing not working? in Getting Data In

Why is WebLogic server.out parsing not working?

cmeerbeek — Tue, 29 Sep 2020 19:49:18 GMT

Hi all,

I have a Splunk installation here with lot's or Oracle WebLogic logging.
Everything except the *server.out files are working great but whatever I do I cannot get it to work properly for those files.

My current props.conf is:

LINE_BREAKER=([\n\r]+)<\w{3}\s\d{1,2},\s\d{4}\s\d{1,2}:\d{1,2}:\d{1,2}\s\w{2}\s\w+>
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=false
TIME_FORMAT=%b %d, %Y %I:%M:%S %P %Z
TIME_PREFIX=^<
TRUNCATE=999999

This works fine when I manually use the data upload via the webui but it is not working from the UF.
Any advice on this?
How does WebLogic write data to this file?

My next step is looking at time_before_close but that is the last resort.

Re: Why is WebLogic server.out parsing not working?

felipesewaybric — Fri, 22 Jun 2018 15:47:29 GMT

The UF(light forwarder) can't use props.conf, you need to use with a Heavy Forwarder

Re: Why is WebLogic server.out parsing not working?

cmeerbeek — Fri, 22 Jun 2018 16:13:56 GMT

Parsing is happening on the HF. I know that the UF can't do that. Sorry for not mentioning this.

Re: Why is WebLogic server.out parsing not working?

woodcock — Fri, 22 Jun 2018 17:46:20 GMT

If you are using UF, then you need to deploy these configurations to the Indexers or switch your UF to HF. Those kinds of props.conf configurations are executed by the first Splunk server that cooks the data which is almost always the first Heavy Forwarder or Indexer. Once deployed to the proper Splunk server(s), all Splunk instances will need to be restarted. Then, only verify on events that have been forwarded in AFTER these restarts (you can use _index_earliest=-2m); older events will stay broken.