Getting Data In

How do I remove STDOUT prefix from log4j on a server.log file?

jefflanier
New Member

I've got a log file that has some log4j entries like this:

2016-05-03 10:32:35,895 INFO  [STDOUT] (http-0.0.0.0-8180-2) 2016-05-03 10:32:35,895 ERROR [com.somewhere.someservice] - Reason : ....

Where I'd like the first part of the line removed so Splunk simply sees the second timestamp ERROR part, but not the initial first timestamp INFO [STDOUT] ...part.

And in the same log file I've got other entries that only have one timestamp, log_level and category part to it like:

2016-05-03 09:05:20,783 INFO  [STDOUT] (main) **** something....

or

2016-05-03 09:05:20,783 ERROR  [com.somewhere.someservice].....

I know I should probably adjust the log4j configuration in the JBoss webapp, but that's not an option, so I'm looking to fix this server side in the props/transforms file.

Any recommendations or can someone point me in the right direction?

0 Karma

somesoni2
Revered Legend

You can use SEDCMD to remove unwanted string from your events. Again, it's recommended that you fix this from source.

http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Anonymizedatausingconfigurationfiles

0 Karma

jefflanier
New Member

I'm not sure I understand how anonymizing the first part of the log entry is going to help. I don't want it showing up or getting indexed at all.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...