topic Re: splunk not showing logs when searched with index in Splunk Search

Why is splunk not showing logs when searched with index?

sindhuja — Tue, 20 Dec 2022 06:59:44 GMT

Hi All,

I have integrated Splunk HEC with springboot .when i hit application and checked in splunk am unable to see logs in splunk search with given index .am using source type as log4j2

Can any one help me .

Thanks in advance

Re: splunk not showing logs when searched with index

yuanliu — Tue, 20 Dec 2022 03:40:05 GMT

Looks like an ingestion problem, not a search problem. You'll get better information by moving this to Getting Data In. Do you have any log indicating that HEC ingestion happened?

Re: Why is splunk not showing logs when searched with index?

gcusello — Tue, 20 Dec 2022 08:02:57 GMT

Hi @sindhuja,

as @yuanliu said, it seems to be an ingestion problem, but to me more sure, you could use a larger search:

index=* sourcetype=log4j

and see results.

Then you could analyze the input phase to identify where's the problem.

Ciao.

Giuseppe

Re: splunk not showing logs when searched with index

sindhuja — Tue, 20 Dec 2022 19:52:50 GMT

hi @yuanliu

How can i check HEC ingestion happened from my application side?

Re: splunk not showing logs when searched with index

yuanliu — Tue, 20 Dec 2022 20:34:06 GMT

I can only say to review logs on both the sender side and splunkd.log. My only experience with HEC is from Puppet's Splunk HEC app, and the only thing I had to figure out was how to force HEC to offer outdated SSL algorithm. (Not the app's fault, just to be clear.) It is hard to read error messages that don't tell you how to solve. But no error message would make it much harder - and absence of error remains a possibility. That's why I suggested Admin forum.