Splunk Enterprise

XML Tags not getting picked up while using Java Splunk SDK

illuminatedaxis
Engager

I have the below configuration in my logback.xml. While the url, token, index sourcetype and disableCertificateValidation fields are getting picked up, the batchInterval, batchCount and sendMode are not.

I ran my application in debug mode, and I did see that the `ch.qos.logback.core.model.processor.AppenderModelHandler` is picking up the these tags as submodels correctly.

Can someone please help me understand if I'm doing anything wrong here?

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
	<appender name="SPLUNK_HTTP" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
		 <url>my-splunk-url</url>
		 <token>my-splunk-token</token>
		 <index>my-index</index>
		 <sourcetype>${USER}_local</sourcetype>
		 <disableCertificateValidation>true</disableCertificateValidation>
		 <batchInterval>1</batchInterval>
		 <batchCount>1000</batchCount>
		 <sendMode>parallel</sendMode>
		 <retriesOnError>1</retriesOnError>
		 <layout class="my-layout-class">
		 <!-- some custom layout configs -->
		 </layout>

	 </appender>


    <logger name="com.myapplication" level="DEBUG" additivity="false">
        <appender-ref ref="SPLUNK_HTTP"/>
    </logger>

    <root level="DEBUG">
        <appender-ref ref="SPLUNK_HTTP"/>
    </root>

</configuration>

 

I'm using the following dependency for splunk, if it matters - 

<dependency>
<groupId>com.splunk.logging</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.11.7</version>
</dependency>

 

 

Labels (2)
0 Karma
1 Solution

livehybrid
Super Champion

Hi @illuminatedaxis 

 

The XML tags you are using for batchInterval, batchCount, sendMode, and retriesOnError do not match the property names expected by the com.splunk.logging.HttpEventCollectorLogbackAppender.

You should use the following tags instead:

<batch_interval> instead of <batchInterval>
<batch_count_size> instead of <batchCount>
<send_mode> instead of <sendMode>
<retries_on_error> instead of <retriesOnError>

Here is your configuration block with the corrected tags:

 

xml
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <appender name="SPLUNK_HTTP" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
         <url>my-splunk-url</url>
         <token>my-splunk-token</token>
         <index>my-index</index>
         <sourcetype>${USER}_local</sourcetype>
         <disableCertificateValidation>true</disableCertificateValidation>
         <batch_interval>1</batch_interval> <!-- Corrected tag -->
         <batch_count_size>1000</batch_count_size> <!-- Corrected tag -->
         <send_mode>parallel</send_mode> <!-- Corrected tag -->
         <retries_on_error>1</retries_on_error> <!-- Corrected tag -->
         <layout class="my-layout-class">
         <!-- some custom layout configs -->
         </layout>
     </appender>

    <logger name="com.myapplication" level="DEBUG" additivity="false">
        <appender-ref ref="SPLUNK_HTTP"/>
    </logger>

    <root level="DEBUG">
        <appender-ref ref="SPLUNK_HTTP"/>
    </root>
</configuration>

 

Logback configures appenders by mapping XML tags to Java setter methods. For example, an XML tag <exampleProperty> would typically call a method setExampleProperty(...) on the appender class. The Splunk logging library's HttpEventCollectorLogbackAppender defines setters like setBatch_interval(String interval), setBatch_count_size(String count), and setSend_mode(String mode). Therefore, the XML tags must match these names, including the underscores.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

livehybrid
Super Champion

Hi @illuminatedaxis 

 

The XML tags you are using for batchInterval, batchCount, sendMode, and retriesOnError do not match the property names expected by the com.splunk.logging.HttpEventCollectorLogbackAppender.

You should use the following tags instead:

<batch_interval> instead of <batchInterval>
<batch_count_size> instead of <batchCount>
<send_mode> instead of <sendMode>
<retries_on_error> instead of <retriesOnError>

Here is your configuration block with the corrected tags:

 

xml
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <appender name="SPLUNK_HTTP" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
         <url>my-splunk-url</url>
         <token>my-splunk-token</token>
         <index>my-index</index>
         <sourcetype>${USER}_local</sourcetype>
         <disableCertificateValidation>true</disableCertificateValidation>
         <batch_interval>1</batch_interval> <!-- Corrected tag -->
         <batch_count_size>1000</batch_count_size> <!-- Corrected tag -->
         <send_mode>parallel</send_mode> <!-- Corrected tag -->
         <retries_on_error>1</retries_on_error> <!-- Corrected tag -->
         <layout class="my-layout-class">
         <!-- some custom layout configs -->
         </layout>
     </appender>

    <logger name="com.myapplication" level="DEBUG" additivity="false">
        <appender-ref ref="SPLUNK_HTTP"/>
    </logger>

    <root level="DEBUG">
        <appender-ref ref="SPLUNK_HTTP"/>
    </root>
</configuration>

 

Logback configures appenders by mapping XML tags to Java setter methods. For example, an XML tag <exampleProperty> would typically call a method setExampleProperty(...) on the appender class. The Splunk logging library's HttpEventCollectorLogbackAppender defines setters like setBatch_interval(String interval), setBatch_count_size(String count), and setSend_mode(String mode). Therefore, the XML tags must match these names, including the underscores.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

illuminatedaxis
Engager

Thanks! This helps.

For anyone interested in this in the future, how it works is that the classcom.splunk.logging.HttpEventCollectorLogbackAppender has setters defined, and the tags need to follow the same scheme as the setters. So, for example, while this field name is _batchCount, the setter is setbatch_size_count, and so the tag needs to be <batch_size_count>

 

 

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...