Splunk Enterprise

XML Tags not getting picked up while using Java Splunk SDK

illuminatedaxis
Engager

I have the below configuration in my logback.xml. While the url, token, index sourcetype and disableCertificateValidation fields are getting picked up, the batchInterval, batchCount and sendMode are not.

I ran my application in debug mode, and I did see that the `ch.qos.logback.core.model.processor.AppenderModelHandler` is picking up the these tags as submodels correctly.

Can someone please help me understand if I'm doing anything wrong here?

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
	<appender name="SPLUNK_HTTP" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
		 <url>my-splunk-url</url>
		 <token>my-splunk-token</token>
		 <index>my-index</index>
		 <sourcetype>${USER}_local</sourcetype>
		 <disableCertificateValidation>true</disableCertificateValidation>
		 <batchInterval>1</batchInterval>
		 <batchCount>1000</batchCount>
		 <sendMode>parallel</sendMode>
		 <retriesOnError>1</retriesOnError>
		 <layout class="my-layout-class">
		 <!-- some custom layout configs -->
		 </layout>

	 </appender>


    <logger name="com.myapplication" level="DEBUG" additivity="false">
        <appender-ref ref="SPLUNK_HTTP"/>
    </logger>

    <root level="DEBUG">
        <appender-ref ref="SPLUNK_HTTP"/>
    </root>

</configuration>

 

I'm using the following dependency for splunk, if it matters - 

<dependency>
<groupId>com.splunk.logging</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.11.7</version>
</dependency>

 

 

Labels (2)
0 Karma
1 Solution

livehybrid
Super Champion

Hi @illuminatedaxis 

 

The XML tags you are using for batchInterval, batchCount, sendMode, and retriesOnError do not match the property names expected by the com.splunk.logging.HttpEventCollectorLogbackAppender.

You should use the following tags instead:

<batch_interval> instead of <batchInterval>
<batch_count_size> instead of <batchCount>
<send_mode> instead of <sendMode>
<retries_on_error> instead of <retriesOnError>

Here is your configuration block with the corrected tags:

 

xml
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <appender name="SPLUNK_HTTP" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
         <url>my-splunk-url</url>
         <token>my-splunk-token</token>
         <index>my-index</index>
         <sourcetype>${USER}_local</sourcetype>
         <disableCertificateValidation>true</disableCertificateValidation>
         <batch_interval>1</batch_interval> <!-- Corrected tag -->
         <batch_count_size>1000</batch_count_size> <!-- Corrected tag -->
         <send_mode>parallel</send_mode> <!-- Corrected tag -->
         <retries_on_error>1</retries_on_error> <!-- Corrected tag -->
         <layout class="my-layout-class">
         <!-- some custom layout configs -->
         </layout>
     </appender>

    <logger name="com.myapplication" level="DEBUG" additivity="false">
        <appender-ref ref="SPLUNK_HTTP"/>
    </logger>

    <root level="DEBUG">
        <appender-ref ref="SPLUNK_HTTP"/>
    </root>
</configuration>

 

Logback configures appenders by mapping XML tags to Java setter methods. For example, an XML tag <exampleProperty> would typically call a method setExampleProperty(...) on the appender class. The Splunk logging library's HttpEventCollectorLogbackAppender defines setters like setBatch_interval(String interval), setBatch_count_size(String count), and setSend_mode(String mode). Therefore, the XML tags must match these names, including the underscores.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

livehybrid
Super Champion

Hi @illuminatedaxis 

 

The XML tags you are using for batchInterval, batchCount, sendMode, and retriesOnError do not match the property names expected by the com.splunk.logging.HttpEventCollectorLogbackAppender.

You should use the following tags instead:

<batch_interval> instead of <batchInterval>
<batch_count_size> instead of <batchCount>
<send_mode> instead of <sendMode>
<retries_on_error> instead of <retriesOnError>

Here is your configuration block with the corrected tags:

 

xml
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <appender name="SPLUNK_HTTP" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
         <url>my-splunk-url</url>
         <token>my-splunk-token</token>
         <index>my-index</index>
         <sourcetype>${USER}_local</sourcetype>
         <disableCertificateValidation>true</disableCertificateValidation>
         <batch_interval>1</batch_interval> <!-- Corrected tag -->
         <batch_count_size>1000</batch_count_size> <!-- Corrected tag -->
         <send_mode>parallel</send_mode> <!-- Corrected tag -->
         <retries_on_error>1</retries_on_error> <!-- Corrected tag -->
         <layout class="my-layout-class">
         <!-- some custom layout configs -->
         </layout>
     </appender>

    <logger name="com.myapplication" level="DEBUG" additivity="false">
        <appender-ref ref="SPLUNK_HTTP"/>
    </logger>

    <root level="DEBUG">
        <appender-ref ref="SPLUNK_HTTP"/>
    </root>
</configuration>

 

Logback configures appenders by mapping XML tags to Java setter methods. For example, an XML tag <exampleProperty> would typically call a method setExampleProperty(...) on the appender class. The Splunk logging library's HttpEventCollectorLogbackAppender defines setters like setBatch_interval(String interval), setBatch_count_size(String count), and setSend_mode(String mode). Therefore, the XML tags must match these names, including the underscores.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

illuminatedaxis
Engager

Thanks! This helps.

For anyone interested in this in the future, how it works is that the classcom.splunk.logging.HttpEventCollectorLogbackAppender has setters defined, and the tags need to follow the same scheme as the setters. So, for example, while this field name is _batchCount, the setter is setbatch_size_count, and so the tag needs to be <batch_size_count>

 

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...