I have an existing app that writes log4j messages as CSV lines using a File appender, and then use the Splunk UF to forward that data to Splunk. I want to just change that to use the HEC, so I've enabled HEC in my Splunk and have added <Http name="http" url="https://localhost:8088/services/collector/raw" token="TOKEN" index="test" source="${logRoot}/${date:yyyy-MM-dd}/${seriesName}/${testName}.${runNumber}/instrument.log" sourcetype="instrument"> <PatternLayout pattern="%m" /> </Http> <Logger name="instrument" level="info" additivity="false"> <AppenderRef ref="http" /> </Logger> I have the splunk logging jar present in the classpath. However, nothing is getting sent to Splunk. I can see there are HTTP connections being made to 8088, but nothing is logged. I suspect that is because I am not using a channel GUID for raw as described here and that the collector is returning an error of some sort, which I can't see logged anywhere. however, I can't find out how to set that up in the log4j configuration. I can use curl to send JSON data to the services/collector endpoint, so the issue is gluing together log4j config and raw Using log4j 2.8.1 directly - not SLF4J. I don't want to rewrite any event data or change code, just replace the File Appender with the HEC. Any suggestions? Thanks ... View more

I have a timechart that shows timechart span=5s fixedrange=f limit=20 perc90(time_taken) by request over 70 minutes. Used for performance testing. It's in a real time dashboard and it shows perfectly well. However, I redraw the complete dashboard to cover the 70 minutes at the end of a test and while the chart fills in, just before the end of drawing all events, all the lines in the chart disappear, leaving only the metrics for OTHER...??? I have opened up the chart in its own search and it will do the same However, this does not always happen for different runs of the same test, but appears consistent with some test runs. There are around 18 million events. I changed the limit= to 15, then 5, but still the same problem. I then changed the limit back to 20 and the span from 5s to 1m and it works. I guess it's a limits thing, but the odd thing is that it never does this for a similar timechart that has a limit=28 on the same data, but is just doing the same timechart, but instead of perc90, is doing count by request ... View more