Developing for Splunk Enterprise

log.cfg to handle custom splunk app logs

coreyCLI
Path Finder

We built a custom app and deployed it in splunk.  It is writing logs in splunk/var/log/appname/appname.log.  I would like to find a way handle the logs natively within splunk, possibly using log.cfg to roll the log at a certain size as well as retention.  I added a stanza to log.cfg in an attempt to manage this log but splunk doesnt appear to care about the added configs.  Anyone use this file in such a way?  Is it even possible?  Below is a snippet of the config I added to log.cfg for the app.  

 

appender.appname=RollingFileAppender
appender.appname.fileName=${SPLUNK_HOME}/var/log/appname/appname.log
appender.appname.maxFileSize=25000000 # default: 25MB (specified in bytes).
appender.appname.maxBackupIndex=5
appender.appname.layout=PatternLayout
appender.appname.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n

Labels (1)
Tags (3)
0 Karma