Streaming with Log4J to Multiple Indexers

[ezajac]

We are looking to use Log4J to stream log files to Splunk Indexers. In my Splunk environment I have three Splunk Indexers. I found configurations that can be used for non clustered Splunk Environment.
I have other servers that use a forwarder with a Splunk Indexing Group configured.

What modifications are needed Log4J Appender to write to multiple indexers the way that the Splunk Forwarders stream log files?

[Damien_Dallimor]

Log4J doesn't have Load Balancing appenders , so you couldn't achieve this functionality , unless you wrote your own custom load balancing appender.

You could however setup multiple appender definitions in your log4j config file that write to multiple indexers (although this could result in duplicated data if your indexers are in a cluster)

Also , have you seen the Splunk logging appenders for Log4J ? There are Raw TCP and REST Appenders for Splunk. Also , some of the functionality of the Splunk Universal Forwarder is mimicked ie: data queueing and auto reconnect upon connectivity errors to the Splunk Indexer.