Splunk failing to show app-name sent via log4j

[mwahaj]

Hi,

I am using Splunk Enterprise 8.0.3 and Log4j 2.13.0. My java application can push log messages to splunk but I am failing to see application name in splunk. I am using the following configuration. As multiple java applications will be sending log messages so I want admin to find easily which application has sent which message on splunk. Is there a workaround? I am using the following log4j setting.

As you can see I am setting appName here but don't see this in splunk.

[mwahaj · Accepted solution]

The issue was fixed.. In splunk app name is show but I was looking at the footer.. My bad.

[mwahaj]

Here is the log4j config.

   <Syslog name="syslog" format="RFC5424" host="localhost" port="1467"
            protocol="TCP" appName="MyApp" includeMDC="true"
            facility="LOCAL0" enterpriseNumber="18060" newLine="true"
            messageId="Audit" id="App"/>