Getting Data In

How do I remove STDOUT prefix from log4j on a server.log file?

jefflanier
New Member

I've got a log file that has some log4j entries like this:

2016-05-03 10:32:35,895 INFO  [STDOUT] (http-0.0.0.0-8180-2) 2016-05-03 10:32:35,895 ERROR [com.somewhere.someservice] - Reason : ....

Where I'd like the first part of the line removed so Splunk simply sees the second timestamp ERROR part, but not the initial first timestamp INFO [STDOUT] ...part.

And in the same log file I've got other entries that only have one timestamp, log_level and category part to it like:

2016-05-03 09:05:20,783 INFO  [STDOUT] (main) **** something....

or

2016-05-03 09:05:20,783 ERROR  [com.somewhere.someservice].....

I know I should probably adjust the log4j configuration in the JBoss webapp, but that's not an option, so I'm looking to fix this server side in the props/transforms file.

Any recommendations or can someone point me in the right direction?

0 Karma

somesoni2
Revered Legend

You can use SEDCMD to remove unwanted string from your events. Again, it's recommended that you fix this from source.

http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Anonymizedatausingconfigurationfiles

0 Karma

jefflanier
New Member

I'm not sure I understand how anonymizing the first part of the log entry is going to help. I don't want it showing up or getting indexed at all.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...