Building for the Splunk Platform

Why am I unable to send the logs to Splunk through log4j2?

se123987
Loves-to-Learn

I'm trying to send my logs from java to splunk through log4j2 . I'm doing log4j2 configuration programatically.

I know this is not the correct way to do so. But I'm still doing this for learning purpose. 

After execution of my java code I see the console appender logs in console but not the splunk appender logs in splunk. I don't know what I'm missing here. 

 

I've tried with postman with same url and token. In this case it works well.

code of my POM file is here ==>

 

 

 

<dependencies>
		<!-- https://mvnrepository.com/artifact/com.splunk/splunk-sdk-java -->
		<dependency>
			<groupId>com.splunk.logging</groupId>
			<artifactId>splunk-library-javalogging</artifactId>
			<version>1.11.4</version>
		</dependency>
		<dependency>
			<groupId>org.apache.logging.log4j</groupId>
			<artifactId>log4j-core</artifactId>
			<version>2.11.2</version>
		</dependency>


		<dependency>
			<groupId>org.apache.logging.log4j</groupId>
			<artifactId>log4j-api</artifactId>
			<version>2.11.2</version>
		</dependency>
		<dependency>
			<groupId>com.splunk</groupId>
			<artifactId>splunk</artifactId>
			<version>1.6.5.0</version>
		</dependency>

	</dependencies>

	<repositories>
		<repository>
			<id>splunk-artifactory</id>
			<name>Splunk Releases</name>
			<url>https://splunk.jfrog.io/splunk/ext-releases-local</url>
		</repository>
	</repositories>

 

 

 

 

my java code is here =>>

 

 

 

import java.util.*;

import org.apache.logging.log4j.Level;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.core.config.Configurator;
import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilder;
import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilderFactory;
import org.apache.logging.log4j.core.config.builder.impl.BuiltConfiguration;
import org.apache.logging.log4j.core.layout.PatternLayout;
import com.splunk.logging.*;
import java.io.*;

public class Main {
	private static final Logger log;

	static {
	  configureLog4J();
	  
	  log = LogManager.getLogger(Main.class);
	}
	public static void configureLog4J() {
		  ConfigurationBuilder<BuiltConfiguration> builder =
				  ConfigurationBuilderFactory.newConfigurationBuilder();

		  // configure a splunk appender
		  builder.add(	  
		      builder.newAppender("splunk", "SplunkHttp")
		          .add(
		              builder.newLayout(PatternLayout.class.getSimpleName())
		                  .addAttribute(
		                      "pattern",
		                      "%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"
		                  )
		          )
		          .addAttribute("sourcetype", "log4j")
		          .addAttribute("index", "main")
		          .addAttribute("url", "http://localhost:8088/services/collector")
		          .addAttribute("token", "XXX")
		          .addAttribute("host", "java")
		          
		          
		          
		          
		  );
		  
		//configure console appender
		  builder.add(
		  builder.newAppender("console", "Console")
          .add(
              builder.newLayout(PatternLayout.class.getSimpleName())
                  .addAttribute(
                      "pattern",
                      "%logger{36}-%msg%n"
                  )
          ));

		  // configure the root logger
		  builder.add(
		      builder.newRootLogger(Level.INFO)
		          .add(builder.newAppenderRef("splunk"))
		          .add(builder.newAppenderRef(("console")))
		  );

		  // apply the configuration
		  Configurator.initialize(builder.build());

		}
	
	public static void main(String ar[]) {
		System.out.println("START");
		log.info("ok");
		log.log(Level.INFO, "BY from log4j2");
		
		log.log(Level.ERROR, "BY Error from log4j2");
		System.out.println("END");
	}
}

 

 

 

 

Labels (1)
0 Karma

PickleRick
Ultra Champion

The obvious approach in such case is to:

1) Trace your program and see what methods are called and what they return.

2) I never used log4j2 but I supposed that due to what it does it would probably catch and silently "drop" many of its own internal exceptions. Check if you can enable internal log4j2 debugging.

3) Verify network traffic to check whether your program is indeed connecting to your indexer and tries to send something or not.

 

0 Karma

VatsalJagani
Champion

@se123987 - Please check this out.

https://dev.splunk.com/enterprise/docs/devtools/java/logging-java/howtouseloggingjava/enableloghttpj...

----------
Please consider upvote if this helps you!!!

0 Karma

se123987
Loves-to-Learn

Hi @VatsalJagani I cannot relate this with my problem. If u know which I miss please tell the exact solution.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...