Splunk Search

Adding splunk logback appender prevents application termination

arash_jalalian
Explorer

I have the following logback configuration and I am using it in a simple java application that does nothing but logging one line. When I uncomment the splunk appender line it won't let the applicaiton exit, eventhough the application is finished. Is there a way to terminate all the logging threads so let the main application exits?

logback.xml

<appender name="SPLUNK" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
    <url>${splunkUrl}</url>
    <token>${splunkToken}</token>
    <source>${projectName}</source>
    <host>${COMPUTERNAME}</host>
    <sourcetype>batch_application_log:json</sourcetype>
    <disableCertificateValidation>true</disableCertificateValidation>
    <!--<messageFormat>json</messageFormat>-->
    <!--<retries_on_error>1</retries_on_error>-->
    <layout class="ch.qos.logback.classic.PatternLayout">
        <pattern>"%msg"</pattern>
    </layout>
</appender>
<root level="INFO">
     <!--<appender-ref ref="SPLUNK"/>--> if I uncomment this line application never exits
</root>

Here is the java code:

public class Main {

public static void main(String[] args) {
    final Logger logger = LoggerFactory.getLogger(Main.class);
    logger.info("******");
}

}

Tags (1)

vijay_iiita
Engager

I also tried the same and facing the same issue. Initially I thought application is not getting terminated on getting exception but same is happening without any exception in Hello World Application. Is there any configuration to prevent this?

0 Karma

Anam
Community Manager
Community Manager

Hi vijay_iiita

This question was posted almost 5 months ago. If the comments and the answer weren't able to help you with your question, please post a new question so you can get maximum exposure and help.

Thanks

0 Karma

vijay_iiita
Engager

Hi asiddique_splunk,

The only answer suggested here is to add custom middleware which check completion of all events. This doesn't seems to be standard solution and more like workaround. Instead I would expect to have exiting behavior as part of Appender configuration if that is intentional. Non existing behavior may be acceptable for web application but might not be suitable for other application which runs on demand like AWS lambda or Spark Job. I am trying to upload logs using Splunk HEC appender for Spark job.

Thanks

0 Karma

SNaikwade
Path Finder

Here is the answer to your question.

0 Karma

arash_jalalian
Explorer

I can't see any answer, maybe you forgot to add a link or something.

0 Karma

SNaikwade
Path Finder

Any resolution on this?

0 Karma

vijay_iiita
Engager

I also tried the same and facing the same issue. Initially I thought application is not getting terminated on getting exception but same is happening without any exception in Hello World Application. Is there any configuration to prevent this?

0 Karma

arash_jalalian
Explorer

I haven't found any solution yet. Had to move on with the Universal Forwarders for now.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...