Why is WebLogic server.out parsing not working?

[cmeerbeek]

Hi all,

I have a Splunk installation here with lot's or Oracle WebLogic logging.
Everything except the *server.out files are working great but whatever I do I cannot get it to work properly for those files.

My current props.conf is:

LINE_BREAKER=([\n\r]+)<\w{3}\s\d{1,2},\s\d{4}\s\d{1,2}:\d{1,2}:\d{1,2}\s\w{2}\s\w+>
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=false
TIME_FORMAT=%b %d, %Y %I:%M:%S %P %Z
TIME_PREFIX=^<
TRUNCATE=999999

This works fine when I manually use the data upload via the webui but it is not working from the UF.
Any advice on this?
How does WebLogic write data to this file?

My next step is looking at time_before_close but that is the last resort.

[woodcock]

If you are using UF, then you need to deploy these configurations to the Indexers or switch your UF to HF. Those kinds of props.conf configurations are executed by the first Splunk server that cooks the data which is almost always the first Heavy Forwarder or Indexer. Once deployed to the proper Splunk server(s), all Splunk instances will need to be restarted. Then, only verify on events that have been forwarded in AFTER these restarts (you can use _index_earliest=-2m); older events will stay broken.

[cmeerbeek]

Parsing is happening on the HF. I know that the UF can't do that. Sorry for not mentioning this.

[felipesewaybric]

The UF(light forwarder) can't use props.conf, you need to use with a Heavy Forwarder