Splunk Dev

log.cfg to handle custom splunk app logs

coreyCLI
Path Finder

We built a custom app and deployed it in splunk.  It is writing logs in splunk/var/log/appname/appname.log.  I would like to find a way handle the logs natively within splunk, possibly using log.cfg to roll the log at a certain size as well as retention.  I added a stanza to log.cfg in an attempt to manage this log but splunk doesnt appear to care about the added configs.  Anyone use this file in such a way?  Is it even possible?  Below is a snippet of the config I added to log.cfg for the app.  

 

appender.appname=RollingFileAppender
appender.appname.fileName=${SPLUNK_HOME}/var/log/appname/appname.log
appender.appname.maxFileSize=25000000 # default: 25MB (specified in bytes).
appender.appname.maxBackupIndex=5
appender.appname.layout=PatternLayout
appender.appname.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...