Getting Data In

Is this the proper approach to sending .log using logback.xml to Splunk?

juliennerocafor
New Member

Hello. I'm trying to integrate splunk with my local project developed in Java.

I have a main project called send-data-service while on the other hand, I have a project named utilities which includes the logging utility that can be re-used by my other projects. Every time send-data-service logs information, it calls the utility service. All of these works fine and also logs information and errors using a logback.xml. This then generates a .log file.

Now, I've read that I should use a splunk logback appender in my current logback.xml so as I can send data to my splunk server (which is hosted via virtual box) every time I try to make a request inside my send-data-service. Although I can't actually make it work. I've already setup a HEC inside splunk but it still does not receive any data. My goal is to send the whole .log file to my splunk server.

This is the content of my logback.xml:

<appender name="http"
            class="com.splunk.logging.HttpEventCollectorLogbackAppender">
            <url>http://localhost:8089</url>
            <token>$token-generated$</token>
            <source>send-data-service</source>
            <sourcetype>logback</sourcetype>
            <messageFormat>text</messageFormat>
            <middleware>HttpEventCollectorUnitTestMiddleware</middleware>
            <layout class="ch.qos.logback.classic.PatternLayout">
                <pattern>%logger: %msg%n</pattern>
            </layout>
        </appender>

        <logger name="splunk.logger" additivity="false" level="INFO">
            <appender-ref ref="http" />
        </logger

I would just also like to ask if i'm using a proper approach? I'm just new in using splunk and I'm really quite lost. Hope anyone can help me with this. Thank you!

Labels (2)
0 Karma

igiannop
New Member

I have exactly the same issue with logback. I have defined sourcetype as logback. Do we have any solution about it ?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...