Getting Data In
Highlighted

Why is WebLogic server.out parsing not working?

Path Finder

Hi all,

I have a Splunk installation here with lot's or Oracle WebLogic logging.
Everything except the *server.out files are working great but whatever I do I cannot get it to work properly for those files.

My current props.conf is:

LINE_BREAKER=([\n\r]+)<\w{3}\s\d{1,2},\s\d{4}\s\d{1,2}:\d{1,2}:\d{1,2}\s\w{2}\s\w+>
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=false
TIME_FORMAT=%b %d, %Y %I:%M:%S %P %Z
TIME_PREFIX=^<
TRUNCATE=999999

This works fine when I manually use the data upload via the webui but it is not working from the UF.
Any advice on this?
How does WebLogic write data to this file?

My next step is looking at timebeforeclose but that is the last resort.

0 Karma
Highlighted

Re: Why is WebLogic server.out parsing not working?

Contributor

The UF(light forwarder) can't use props.conf, you need to use with a Heavy Forwarder

0 Karma
Highlighted

Re: Why is WebLogic server.out parsing not working?

Path Finder

Parsing is happening on the HF. I know that the UF can't do that. Sorry for not mentioning this.

0 Karma
Highlighted

Re: Why is WebLogic server.out parsing not working?

Esteemed Legend

If you are using UF, then you need to deploy these configurations to the Indexers or switch your UF to HF. Those kinds of props.conf configurations are executed by the first Splunk server that cooks the data which is almost always the first Heavy Forwarder or Indexer. Once deployed to the proper Splunk server(s), all Splunk instances will need to be restarted. Then, only verify on events that have been forwarded in AFTER these restarts (you can use _index_earliest=-2m); older events will stay broken.

0 Karma