Splunk Dev

Log4j Selective logging

viranis
Explorer

I have a setup where I have configured Log4j2 within a springboot service and have setup HEC on Splunk. The setup is working brilliantly where the logs are pushed to splunk without any issues. 

My question is, is there a mechanism where i can control the kinds of logs pushed via HEC ? For example, my log file prints a lot of information like queries, logged in user data, application's exception stack traces, etc. and currently everything goes to Splunk. Is there a way where I can control to push maybe just the exceptions or just the logged in user info, etc ? Is this possible ?

If not, are there any other options that I should explore ?

Appreciate in advance

0 Karma
1 Solution

viranis
Explorer

Okay, i found a way to do this. I used RegexFilter within log4j2's SplunkHttp Appender to capture very specific logs and only those now flow to Splunk. 

View solution in original post

0 Karma

viranis
Explorer

Okay, i found a way to do this. I used RegexFilter within log4j2's SplunkHttp Appender to capture very specific logs and only those now flow to Splunk. 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...