Splunk Search

Adding splunk logback appender prevents application termination

arash_jalalian
Explorer

I have the following logback configuration and I am using it in a simple java application that does nothing but logging one line. When I uncomment the splunk appender line it won't let the applicaiton exit, eventhough the application is finished. Is there a way to terminate all the logging threads so let the main application exits?

logback.xml

<appender name="SPLUNK" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
    <url>${splunkUrl}</url>
    <token>${splunkToken}</token>
    <source>${projectName}</source>
    <host>${COMPUTERNAME}</host>
    <sourcetype>batch_application_log:json</sourcetype>
    <disableCertificateValidation>true</disableCertificateValidation>
    <!--<messageFormat>json</messageFormat>-->
    <!--<retries_on_error>1</retries_on_error>-->
    <layout class="ch.qos.logback.classic.PatternLayout">
        <pattern>"%msg"</pattern>
    </layout>
</appender>
<root level="INFO">
     <!--<appender-ref ref="SPLUNK"/>--> if I uncomment this line application never exits
</root>

Here is the java code:

public class Main {

public static void main(String[] args) {
    final Logger logger = LoggerFactory.getLogger(Main.class);
    logger.info("******");
}

}

Tags (1)

vijay_iiita
Engager

I also tried the same and facing the same issue. Initially I thought application is not getting terminated on getting exception but same is happening without any exception in Hello World Application. Is there any configuration to prevent this?

0 Karma

Anam
Community Manager
Community Manager

Hi vijay_iiita

This question was posted almost 5 months ago. If the comments and the answer weren't able to help you with your question, please post a new question so you can get maximum exposure and help.

Thanks

0 Karma

vijay_iiita
Engager

Hi asiddique_splunk,

The only answer suggested here is to add custom middleware which check completion of all events. This doesn't seems to be standard solution and more like workaround. Instead I would expect to have exiting behavior as part of Appender configuration if that is intentional. Non existing behavior may be acceptable for web application but might not be suitable for other application which runs on demand like AWS lambda or Spark Job. I am trying to upload logs using Splunk HEC appender for Spark job.

Thanks

0 Karma

SNaikwade
Path Finder

Here is the answer to your question.

0 Karma

arash_jalalian
Explorer

I can't see any answer, maybe you forgot to add a link or something.

0 Karma

SNaikwade
Path Finder

Any resolution on this?

0 Karma

vijay_iiita
Engager

I also tried the same and facing the same issue. Initially I thought application is not getting terminated on getting exception but same is happening without any exception in Hello World Application. Is there any configuration to prevent this?

0 Karma

arash_jalalian
Explorer

I haven't found any solution yet. Had to move on with the Universal Forwarders for now.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...