Splunk Search

Why is splunk not showing logs when searched with index?

sindhuja
Loves-to-Learn Lots

Hi All,

 

I have integrated Splunk HEC with springboot .when i hit application and checked in splunk am unable to see logs in splunk search with given index .am using source type as log4j2 

Can any one help me .

 

Thanks in advance

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sindhuja,

as @yuanliu said, it seems to be an ingestion problem, but to me more sure, you could use a larger search:

index=* sourcetype=log4j

and see results.

Then you could analyze the input phase to identify where's the problem.

Ciao.

Giuseppe

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Looks like an ingestion problem, not a search problem.  You'll get better information by moving this to Getting Data In.  Do you have any log indicating that HEC ingestion happened?

0 Karma

sindhuja
Loves-to-Learn Lots

hi @yuanliu

 

How can i check HEC ingestion happened from my application side?

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I can only say to review logs on both the sender side and splunkd.log.  My only experience with HEC is from Puppet's Splunk HEC app, and the only thing I had to figure out was how to force HEC to offer outdated SSL algorithm. (Not the app's fault, just to be clear.)  It is hard to read error messages that don't tell you how to solve.  But no error message would make it much harder - and absence of error remains a possibility.  That's why I suggested Admin forum.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...