Getting Data In

Is this the proper approach to sending .log using logback.xml to Splunk?

juliennerocafor
New Member

Hello. I'm trying to integrate splunk with my local project developed in Java.

I have a main project called send-data-service while on the other hand, I have a project named utilities which includes the logging utility that can be re-used by my other projects. Every time send-data-service logs information, it calls the utility service. All of these works fine and also logs information and errors using a logback.xml. This then generates a .log file.

Now, I've read that I should use a splunk logback appender in my current logback.xml so as I can send data to my splunk server (which is hosted via virtual box) every time I try to make a request inside my send-data-service. Although I can't actually make it work. I've already setup a HEC inside splunk but it still does not receive any data. My goal is to send the whole .log file to my splunk server.

This is the content of my logback.xml:

<appender name="http"
            class="com.splunk.logging.HttpEventCollectorLogbackAppender">
            <url>http://localhost:8089</url>
            <token>$token-generated$</token>
            <source>send-data-service</source>
            <sourcetype>logback</sourcetype>
            <messageFormat>text</messageFormat>
            <middleware>HttpEventCollectorUnitTestMiddleware</middleware>
            <layout class="ch.qos.logback.classic.PatternLayout">
                <pattern>%logger: %msg%n</pattern>
            </layout>
        </appender>

        <logger name="splunk.logger" additivity="false" level="INFO">
            <appender-ref ref="http" />
        </logger

I would just also like to ask if i'm using a proper approach? I'm just new in using splunk and I'm really quite lost. Hope anyone can help me with this. Thank you!

Labels (2)
0 Karma

igiannop
New Member

I have exactly the same issue with logback. I have defined sourcetype as logback. Do we have any solution about it ?

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...