How to add application data into Splunk?

[gregtonn]

I have a legacy application and I want to get as much application data into Splunk as I can. I'm hoping to go well beyond what our current logs can provide. If I could do this with little to no development, it would be best.

I know there is Splunk Stream, but is there any thing else that would allow for this?

We are currently using Splunk Enterprise 6.2.

[woodcock]

There is no practical way to crack open an app and pry useful information out of it. As you noted, stream allows you to snoop the wire and you will be able to see where you app is going and what it is saying but this is not all it is cracked up to be as you will find out soon enough if you go that route. The right thing to do is to get with your application developers and have them modify the source code to enhance the logging and then upgrade the apps. There are many logging tools that make enhanced logging easier and also friendly to Splunk. Check out the JSON logging libraries and start there.