Is there a way to deserialize the LoggingEvent produced by Log4J when using the socket appender? Splunk appears to receive the messages but is unable to understand/parse them.
Well that is really my question, is there a way to deserialize the object Log4J creates (LoggingEvent) so that Splunk can read it? We're trying to avoid flat files if possible.
provided your log events are plain text delimited by newlines, it should be fine. (other delimiters can be configured.) what exactly is failing to parse? are lines breaking? are timestamps read correctly? or is is problems with field extractions?
