Getting Data In

Why am I unable to see springboot application logs in splunk?

sindhuja
Loves-to-Learn Lots

Hi All,

 

I have integrated Splunk HEC with springboot .when i hit application and checked in splunk am unable to see logs in splunk search with given index .am using source type as log4j2 

 

below is my log4j2 xml file

<?xml version="1.0" encoding="UTF-8"?>
<Configuration>
<Appenders>
<Console name="console" target="SYSTEM_OUT">
<PatternLayout
pattern="%style{%d{ISO8601}} %highlight{%-5level }[%style{%t}{bright,blue}] %style{%C{10}}{bright,yellow}: %msg%n%throwable" />
</Console>
<SplunkHttp
name="splunkhttp"
url="https://localhost:8088"
token="xxxx-xxxx-xxxx-xxxx"
host="localhost"
index="vehicle-api_dev"
type="raw"
source="http-event-logs"
sourcetype="log4j"
messageFormat="text"
disableCertificateValidation="true"
>
<PatternLayout pattern="%m" />
</SplunkHttp>

</Appenders>

<Loggers>
<!-- LOG everything at INFO level -->
<Root level="info">
<AppenderRef ref="console" />
<AppenderRef ref="splunkhttp" />
</Root>
</Loggers>
</Configuration>

 

my pom.xml configurations related to splunk 

<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-log4j2</artifactId>
</dependency>
<dependency>
<groupId>com.splunk.logging</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.8.0</version>
<scope>runtime</scope>
</dependency>

<repositories>
<repository>
<id>splunk-artifactory</id>
<name>Splunk Releases</name>
<url>https://splunk.jfrog.io/splunk/ext-releases-local</url>
</repository>
</repositories>

 

I am unable to see logs 

sindhuja_0-1671568387910.png

 

Can any one help me .

 

 

Thanks in advance

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...

Observability Cloud | AWS PrivateLink Enabled for Splunk Observability Cloud

We’ve enabled AWS PrivateLink for Observability Cloud, giving you an additional inbound connection to send ...

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...