Splunk Dev

Log4j Selective logging

viranis
Explorer

I have a setup where I have configured Log4j2 within a springboot service and have setup HEC on Splunk. The setup is working brilliantly where the logs are pushed to splunk without any issues. 

My question is, is there a mechanism where i can control the kinds of logs pushed via HEC ? For example, my log file prints a lot of information like queries, logged in user data, application's exception stack traces, etc. and currently everything goes to Splunk. Is there a way where I can control to push maybe just the exceptions or just the logged in user info, etc ? Is this possible ?

If not, are there any other options that I should explore ?

Appreciate in advance

0 Karma
1 Solution

viranis
Explorer

Okay, i found a way to do this. I used RegexFilter within log4j2's SplunkHttp Appender to capture very specific logs and only those now flow to Splunk. 

View solution in original post

0 Karma

viranis
Explorer

Okay, i found a way to do this. I used RegexFilter within log4j2's SplunkHttp Appender to capture very specific logs and only those now flow to Splunk. 

0 Karma
Get Updates on the Splunk Community!

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...

Application management with Targeted Application Install for Victoria Experience

Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...