There are a few things you may need to further answer and check to see if you have un-commented out the appender earlier in the log4j*xml I put * now that they have moved to log4j2.xml in the latest (8.0.1) release. <appender-ref ref="SecurityAudit2Splunk"/> should go where SecurityAudit2File is on the line below. You also have to do this for every configuration, Do a search for `` and update every config that you want this active for (*Sp, Idp, OAuth, etc.) Example for SP Audit Logging, Should look like: Logger name="org.sourceid.websso.profiles.sp.SpAuditLogger" level="INFO" additivity="false" includeLocation="false"> <appender-ref ref="SecurityAudit2File" /> <appender-ref ref="SecurityAudit2Splunk"/> *Remember to do this for any Audit logging configuration you need to see logs for. ... View more