Archive

Log4J SocketAppender & LoggingEvent

New Member

Is there a way to deserialize the LoggingEvent produced by Log4J when using the socket appender? Splunk appears to receive the messages but is unable to understand/parse them.

Tags (1)
0 Karma

Engager

I think the Log4J SocketAppender serializes Java Objects, so to Splunk it is not a text file.

New Member

Well that is really my question, is there a way to deserialize the object Log4J creates (LoggingEvent) so that Splunk can read it? We're trying to avoid flat files if possible.

0 Karma

Splunk Employee
Splunk Employee

provided your log events are plain text delimited by newlines, it should be fine. (other delimiters can be configured.) what exactly is failing to parse? are lines breaking? are timestamps read correctly? or is is problems with field extractions?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!