Splunk Enterprise

Why cant I see my Splunk logs?

goldsilver12
Observer

I can't see my logs, Stack: Spring boot , Maven

Here is my pom file:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.0.2</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<groupId>com.example</groupId>
<artifactId>SpringBootCRUDWithSplunkIntegration</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>SpringBootCRUDWithSplunkIntegration</name>
<description>SpringBootCRUDWithSplunkIntegration</description>
<properties>
<java.version>17</java.version>
</properties>

<repositories>
<repository>
<id>splunk-artifactory</id>
<name>Splunk Releases</name>
<url>https://splunk.jfrog.io/splunk/ext-releases-local</url>
</repository>
</repositories>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<exclusions>
<exclusion>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-logging</artifactId>
</exclusion>
</exclusions>
</dependency>

<!-- https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-log4j -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-log4j2</artifactId>
</dependency>
<!-- https://mvnrepository.com/artifact/com.splunk.logging/splunk-library-javalogging -->
<dependency>
<groupId>com.splunk.logging</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.8.0</version>
<scope>runtime</scope>
</dependency>

<dependency>
<groupId>org.postgresql</groupId>
<artifactId>postgresql</artifactId>
<scope>runtime</scope>
</dependency>
<!-- https://mvnrepository.com/artifact/org.umlg/sqlg-postgres-dialect -->
<dependency>
<groupId>org.umlg</groupId>
<artifactId>sqlg-postgres-dialect</artifactId>
<version>1.3.2</version>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>1.2.12</version>
</dependency>
</dependencies>

<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<configuration>
<excludes>
<exclude>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
</exclude>
</excludes>
</configuration>
</plugin>
</plugins>
</build>

</project>



Here is my log4j.xml

<?xml version="1.0" encoding="UTF-8"?>
<Configuration>
<Appenders>
<Console name="console" target="SYSTEM_OUT">
<PatternLayout
pattern="%style{%d{ISO8601}} %highlight{%-5level }[%style{%t}{bright,blue}] %style{%C{10}}{bright,yellow}: %msg%n%throwable" />
</Console>
<SplunkHttp
name="splunkhttp"
url="http://127.0.0.1:8088"
token="c7d19018-8e86-4c22-ace8-00903bb92845"
host="localhost"
index="spring_dev"
type="raw"
source="source name"
sourcetype="log4j"
messageFormat="text"
disableCertificateValidation="true">
<PatternLayout pattern="%m" />
</SplunkHttp>

</Appenders>

<Loggers>
<Root level="info">
<AppenderRef ref="console" />
<AppenderRef ref="splunkhttp" />
</Root>
</Loggers>
</Configuration>

goldsilver12_0-1690836070436.pnggoldsilver12_1-1690836103504.png

goldsilver12_2-1690836149451.png

Can anybody help with that issue,  I've tried everything literary

 

 

Labels (1)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

I dunno. Since HEC works on port 8088 (and your log4j configuration seems to be pointed on that port properly) limit your network dump to port 8088 and see if there is any traffic there. Does the TCP session get properly initialized, processed and closed? If so, check the HTTP transaction that's going on inside that session - do you get the proper HTTP POST request? Is it received properly and responded with a normal 200 OK code?

0 Karma

goldsilver12
Observer

I'm a Windows user so I didn't try that. Do you think that the problem is in sending packages? 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you tried "everything", you must have tried dumping the traffic from the (loopback) interface with tcpdump. What does it show?

0 Karma

goldsilver12
Observer

goldsilver12_0-1690839269161.png

 

0 Karma

goldsilver12
Observer

goldsilver12_0-1690838999310.png

 

0 Karma

goldsilver12
Observer

I'm a Windows user so I didn't try that. Do you think that the problem is in sending packets? 

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...