Splunk solved this problem in v 8.1.1 by implementing polkit along with Systemd.  ./splunk enable boot-start -systemd-managed 1 -create-polkit-rules 1 -user <username> Depends on Polkit and systemd version available on your system, Splunk will give granular access to the user mentioned in above command.  Polkit  helps to not hand out  {{sudo}}  access to the user, so its a helpful feature for systemd. https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/RunSplunkassystemdservice#:~:text=file%20naming%20considerations.-,Install%20polkit%20rules%20to%20elevate%20user%20permissions,-In%20version%208.1.1   ... View more

This is a known bug, which affects all of the mechanisms implemented by the splunk-library-javalogging, not just logback. Here, for example, is the Github issue for a log4j2 part. Fixes, such as this one are offered for the HttpEventCollectorResendMiddleware.java , which would fix all logging methods at once too. No idea, why this still is not in the released JAR 😞 ... View more

Hi asiddique_splunk, The only answer suggested here is to add custom middleware which check completion of all events. This doesn't seems to be standard solution and more like workaround. Instead I would expect to have exiting behavior as part of Appender configuration if that is intentional. Non existing behavior may be acceptable for web application but might not be suitable for other application which runs on demand like AWS lambda or Spark Job. I am trying to upload logs using Splunk HEC appender for Spark job. Thanks ... View more

Hi, Did you ever get to the bottom of this? I have the same issue. ... View more

@SNaikwade... Glad that it worked!!! Please accept the answers if it has helped. ... View more

There is now official documentation on this: https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/RunSplunkassystemdservice ... View more