Splunk Enterprise

XML Tags not getting picked up while using Java Splunk SDK

illuminatedaxis
Engager

I have the below configuration in my logback.xml. While the url, token, index sourcetype and disableCertificateValidation fields are getting picked up, the batchInterval, batchCount and sendMode are not.

I ran my application in debug mode, and I did see that the `ch.qos.logback.core.model.processor.AppenderModelHandler` is picking up the these tags as submodels correctly.

Can someone please help me understand if I'm doing anything wrong here?

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
	<appender name="SPLUNK_HTTP" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
		 <url>my-splunk-url</url>
		 <token>my-splunk-token</token>
		 <index>my-index</index>
		 <sourcetype>${USER}_local</sourcetype>
		 <disableCertificateValidation>true</disableCertificateValidation>
		 <batchInterval>1</batchInterval>
		 <batchCount>1000</batchCount>
		 <sendMode>parallel</sendMode>
		 <retriesOnError>1</retriesOnError>
		 <layout class="my-layout-class">
		 <!-- some custom layout configs -->
		 </layout>

	 </appender>


    <logger name="com.myapplication" level="DEBUG" additivity="false">
        <appender-ref ref="SPLUNK_HTTP"/>
    </logger>

    <root level="DEBUG">
        <appender-ref ref="SPLUNK_HTTP"/>
    </root>

</configuration>

 

I'm using the following dependency for splunk, if it matters - 

<dependency>
<groupId>com.splunk.logging</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.11.7</version>
</dependency>

 

 

Labels (2)
0 Karma
1 Solution

livehybrid
Super Champion

Hi @illuminatedaxis 

 

The XML tags you are using for batchInterval, batchCount, sendMode, and retriesOnError do not match the property names expected by the com.splunk.logging.HttpEventCollectorLogbackAppender.

You should use the following tags instead:

<batch_interval> instead of <batchInterval>
<batch_count_size> instead of <batchCount>
<send_mode> instead of <sendMode>
<retries_on_error> instead of <retriesOnError>

Here is your configuration block with the corrected tags:

 

xml
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <appender name="SPLUNK_HTTP" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
         <url>my-splunk-url</url>
         <token>my-splunk-token</token>
         <index>my-index</index>
         <sourcetype>${USER}_local</sourcetype>
         <disableCertificateValidation>true</disableCertificateValidation>
         <batch_interval>1</batch_interval> <!-- Corrected tag -->
         <batch_count_size>1000</batch_count_size> <!-- Corrected tag -->
         <send_mode>parallel</send_mode> <!-- Corrected tag -->
         <retries_on_error>1</retries_on_error> <!-- Corrected tag -->
         <layout class="my-layout-class">
         <!-- some custom layout configs -->
         </layout>
     </appender>

    <logger name="com.myapplication" level="DEBUG" additivity="false">
        <appender-ref ref="SPLUNK_HTTP"/>
    </logger>

    <root level="DEBUG">
        <appender-ref ref="SPLUNK_HTTP"/>
    </root>
</configuration>

 

Logback configures appenders by mapping XML tags to Java setter methods. For example, an XML tag <exampleProperty> would typically call a method setExampleProperty(...) on the appender class. The Splunk logging library's HttpEventCollectorLogbackAppender defines setters like setBatch_interval(String interval), setBatch_count_size(String count), and setSend_mode(String mode). Therefore, the XML tags must match these names, including the underscores.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

livehybrid
Super Champion

Hi @illuminatedaxis 

 

The XML tags you are using for batchInterval, batchCount, sendMode, and retriesOnError do not match the property names expected by the com.splunk.logging.HttpEventCollectorLogbackAppender.

You should use the following tags instead:

<batch_interval> instead of <batchInterval>
<batch_count_size> instead of <batchCount>
<send_mode> instead of <sendMode>
<retries_on_error> instead of <retriesOnError>

Here is your configuration block with the corrected tags:

 

xml
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <appender name="SPLUNK_HTTP" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
         <url>my-splunk-url</url>
         <token>my-splunk-token</token>
         <index>my-index</index>
         <sourcetype>${USER}_local</sourcetype>
         <disableCertificateValidation>true</disableCertificateValidation>
         <batch_interval>1</batch_interval> <!-- Corrected tag -->
         <batch_count_size>1000</batch_count_size> <!-- Corrected tag -->
         <send_mode>parallel</send_mode> <!-- Corrected tag -->
         <retries_on_error>1</retries_on_error> <!-- Corrected tag -->
         <layout class="my-layout-class">
         <!-- some custom layout configs -->
         </layout>
     </appender>

    <logger name="com.myapplication" level="DEBUG" additivity="false">
        <appender-ref ref="SPLUNK_HTTP"/>
    </logger>

    <root level="DEBUG">
        <appender-ref ref="SPLUNK_HTTP"/>
    </root>
</configuration>

 

Logback configures appenders by mapping XML tags to Java setter methods. For example, an XML tag <exampleProperty> would typically call a method setExampleProperty(...) on the appender class. The Splunk logging library's HttpEventCollectorLogbackAppender defines setters like setBatch_interval(String interval), setBatch_count_size(String count), and setSend_mode(String mode). Therefore, the XML tags must match these names, including the underscores.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

illuminatedaxis
Engager

Thanks! This helps.

For anyone interested in this in the future, how it works is that the classcom.splunk.logging.HttpEventCollectorLogbackAppender has setters defined, and the tags need to follow the same scheme as the setters. So, for example, while this field name is _batchCount, the setter is setbatch_size_count, and so the tag needs to be <batch_size_count>

 

 

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...