https://community.splunk.com/t5/Getting-Data-In/Log4J-SocketAppender-LoggingEvent/m-p/24623#M96613 <P>I think the Log4J SocketAppender serializes Java Objects, so to Splunk it is not a text file.</P> Wed, 04 Aug 2010 12:58:26 GMT willpugh 2010-08-04T12:58:26Z https://community.splunk.com/t5/Getting-Data-In/Log4J-SocketAppender-LoggingEvent/m-p/24621#M96611 <P>Is there a way to deserialize the LoggingEvent produced by Log4J when using the socket appender? Splunk appears to receive the messages but is unable to understand/parse them. </P> Tue, 03 Aug 2010 23:17:29 GMT https://community.splunk.com/t5/Getting-Data-In/Log4J-SocketAppender-LoggingEvent/m-p/24621#M96611 Saltie06 2010-08-03T23:17:29Z https://community.splunk.com/t5/Getting-Data-In/Log4J-SocketAppender-LoggingEvent/m-p/24622#M96612 <P>provided your log events are plain text delimited by newlines, it should be fine. (other delimiters can be configured.) what exactly is failing to parse? are lines breaking? are timestamps read correctly? or is is problems with field extractions?</P> Tue, 03 Aug 2010 23:58:24 GMT https://community.splunk.com/t5/Getting-Data-In/Log4J-SocketAppender-LoggingEvent/m-p/24622#M96612 gkanapathy 2010-08-03T23:58:24Z https://community.splunk.com/t5/Getting-Data-In/Log4J-SocketAppender-LoggingEvent/m-p/24623#M96613 <P>I think the Log4J SocketAppender serializes Java Objects, so to Splunk it is not a text file.</P> Wed, 04 Aug 2010 12:58:26 GMT https://community.splunk.com/t5/Getting-Data-In/Log4J-SocketAppender-LoggingEvent/m-p/24623#M96613 willpugh 2010-08-04T12:58:26Z https://community.splunk.com/t5/Getting-Data-In/Log4J-SocketAppender-LoggingEvent/m-p/24624#M96614 <P>Well that is really my question, is there a way to deserialize the object Log4J creates (LoggingEvent) so that Splunk can read it? We're trying to avoid flat files if possible.</P> Mon, 09 Aug 2010 20:49:15 GMT https://community.splunk.com/t5/Getting-Data-In/Log4J-SocketAppender-LoggingEvent/m-p/24624#M96614 Saltie06 2010-08-09T20:49:15Z