topic Using Splunk HTTP Event Collector with log4j2 in Getting Data In

Using Splunk HTTP Event Collector with log4j2

crippled-ankle — Sun, 11 Oct 2020 03:04:45 GMT

Hi,

I'm trying to use SplunkHTTPAppender in production, the set up (log4j2.xml) works in development environment. But when I switch to production, http collector metrics (_introspection) starts to show data.num_of_requests_to_incorrect_url > 1 and no events are posted.

Is there a way to know the url used in event posting? and what is the criteria to determine a wrong url?

Thank you!

Re: Using Splunk HTTP Event Collector with log4j2

crippled-ankle — Sun, 11 Oct 2020 03:25:38 GMT

My config is like below,

<?xml version="1.0" encoding="UTF-8"?> <Configuration status="info" name="example" packages="com.splunk.logging"> <Appenders> <SplunkHttp name="splunk" url="http://localhost:8088" token="token" index="comminimizer" messageFormat="text" batch_size_count="1" disableCertificateValidation="true" > <PatternLayout pattern="%m"/> </SplunkHttp> </Appenders> <Loggers> <Root level="INFO"> <AppenderRef ref="splunk"/> </Root> </Loggers> </Configuration>

Re: Using Splunk HTTP Event Collector with log4j2

crippled-ankle — Sun, 11 Oct 2020 19:28:13 GMT