Splunk Enterprise

Why am I getting "java.lang.NoSuchFieldError: DEFAULT" using splunk-library-javalogging to enable logging to HTTP Event Collector?

lhsihan
Explorer

I am trying to enable logging to HTTP Event Collector in the Java project with java.util.logging.
The code is very simple:

import java.util.logging.;
import com.splunk.logging.;
......................
Logger logger = Logger.getLogger("splunkLogger");
logger.info("This is a test event for Logback test");

And the property file (config/jdklogging.properties) is like this:

splunkLogger.level = INFO
splunkLogger.handlers = com.splunk.logging.HttpEventCollectorLoggingHandler
com.splunk.logging.HttpEventCollectorLoggingHandler.url = https://192.168.99.100:8088/services/collector
com.splunk.logging.HttpEventCollectorLoggingHandler.level = INFO
com.splunk.logging.HttpEventCollectorLoggingHandler.token = 00E4854F-53D4-4A1E-934C-EF5945DF790D
com.splunk.logging.HttpEventCollectorLoggingHandler.disableCertificateValidation=true

When I run the java code with -Djava.util.logging.config.file=config/jdklogging.properties, the error popped up:

Exception in thread "Timer-0" java.lang.NoSuchFieldError: DEFAULT
at org.apache.http.impl.nio.client.HttpAsyncClientBuilder.build(HttpAsyncClientBuilder.java:603)
at com.splunk.logging.HttpEventCollectorSender.startHttpClient(HttpEventCollectorSender.java:234)
at com.splunk.logging.HttpEventCollectorSender.postEvents(HttpEventCollectorSender.java:277)
at com.splunk.logging.HttpEventCollectorMiddleware.postEvents(HttpEventCollectorMiddleware.java:86)
at com.splunk.logging.HttpEventCollectorSender.postEventsAsync(HttpEventCollectorSender.java:256)
at com.splunk.logging.HttpEventCollectorSender.flush(HttpEventCollectorSender.java:152)
at com.splunk.logging.HttpEventCollectorSender.run(HttpEventCollectorSender.java:175)
at java.util.TimerThread.mainLoop(Unknown Source)

PS:
I could send the log to splunk http event collector by the following commands:

curl -k -H "Authorization: Splunk 00E4854F-53D4-4A1E-934C-EF5945DF790D" https
://xxx.xxx.xx.xxx:8088/services/collector/event -d '{"event":"test splunk"}'

Could you please give me help on this? Thank you very much!

1 Solution

lhsihan
Explorer

Fixed the problem by updating the dependency jar files. Thanks everyone.

View solution in original post

lhsihan
Explorer

Fixed the problem by updating the dependency jar files. Thanks everyone.

saurabh009
Path Finder

I am also facing similar issue, Can you please let me know which dependency jar you updated to fix this issue?

0 Karma

lhsihan
Explorer

Thank you very much for helping me format my content!

ppablo
Retired

You're very welcome @lhsihan 🙂

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...