topic Re: Logging with Splunk in Dashboards & Visualizations

Logging with Splunk

Emre — Tue, 17 Jun 2025 07:06:35 GMT

Hi everyone,
I am a Mendix developer and i would like to implementSplunkCloud for monitoring.
I already have the HEC token port and hostname in my Mendix cloud environment.
I would like to send error logs to SplunkCloud from Mx.
Based on my research JSON format is a common practice.
Is there any way where i can send my data to Splunk as a JSON format? Idk how that works for Splunk.
Any suggestions?

Re: Logging with Splunk

gcusello — Tue, 17 Jun 2025 07:13:36 GMT

Hi @Emre ,

Splunk has many ways to ingest logs: syslog, HEC, API, etc..., which way can be implemented on Mendix?

anyway, see at https://docs.mendix.com/developerportal/operate/splunk-metrics/ and you should find the solution.

Ciao.

Giuseppe

Re: Logging with Splunk

Emre — Tue, 17 Jun 2025 07:18:53 GMT

Thanks @gcusello ,
I already implemented the mendix documentation. It sends some data to Splunk. And i use HEC method.
But i would like to send some spesicifc data. for example Http status or Latest error message. In mendix i create logs and i added those values inside. But how do i display or get this information in Splunk. I only see some values such as hostname or level..

Re: Logging with Splunk

livehybrid — Tue, 17 Jun 2025 07:44:03 GMT

Hi @Emre

Yes, you can send JSON via HEC into Splunk Enterprise / Splunk Cloud. Check out https://docs.splunk.com/Documentation/Splunk/9.4.2/Data/HECExamples which has some good examples on how you can do this, but at a basic level you have two options, you can send raw JSON to https://mysplunkserver.example.com:8088/services/collector/raw or you can send structured events to https://mysplunkserver.example.com:8088/services/collector/event

A structured even for the /event endpoint would look something like this:

{
    "time": 1426279439, // epoch time
    "host": "localhost",
    "source": "random-data-generator",
    "sourcetype": "my_sample_data",
    "index": "main",
    "event":  "Hello world!" // or {"yourKey":"yourVal"} for example
}

Check out https://docs.splunk.com/Documentation/Splunk/9.4.2/Data/FormateventsforHTTPEventCollector for more info on field you can send to events to HEC.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Logging with Splunk

gcusello — Tue, 17 Jun 2025 07:46:53 GMT

Hi @Emre ,

Splunk displays the logs that it receives, are you sure that you are sending these data to Splunk?

Do you see these data in the raw logs in Splunk?

Maybe the issue is the not correct parsing, see at https://docs.mendix.com/developerportal/operate/splunk-metrics/ to be guided.

Ciao.

Giuseppe

Re: Logging with Splunk

Emre — Tue, 17 Jun 2025 12:38:02 GMT

One more question since i am new to this platform i am wondering how can search for a certain error/ warning or info message. Such as how to seach for " 404 - file not found for file "

Re: Logging with Splunk

Emre — Tue, 17 Jun 2025 14:02:54 GMT

Sample 1: I sent the logs from Mendix to Splunk, but all the messages are saved within message.
{
level: ERROR
env: test
Message: {"Module": SplunkTest""Microflow": ACT_Splunk_Create_Test""latesterror_message": "401: Access Denied at SplunkTest.ACT_Omnext_Create_TEST (CallRest : 'Call REST (POST)') Advanced stacktrace:"http_status": "401"http_response_content": "{ "statusCode": 401, "message": "Access denied due to invalid subscription key. Make sure to provide a valid key for an active subscription." }"http_reasonphrase": "Access Denied"session_id": "13314141414141212}

but i would like to extract some data from the message as below
{
level: ERROR
env: test
Module: SplunkTest
Microflow: ACT_Splunk_Create_Test
http_reasonphrase: Access Denied
session_id: 13314141414141212
}
My question is, can this message adjustable like my wish from Splunk. or Do i need to find a way to send data from Mendix in a structured way.

Re: Logging with Splunk

isoutamo — Tue, 17 Jun 2025 14:18:18 GMT

When you send valid json object you can query any data what it contains. You could utilize those keys or use just any words which it has.