Getting Data In

Is this the proper approach to sending .log using logback.xml to Splunk?

juliennerocafor
New Member

Hello. I'm trying to integrate splunk with my local project developed in Java.

I have a main project called send-data-service while on the other hand, I have a project named utilities which includes the logging utility that can be re-used by my other projects. Every time send-data-service logs information, it calls the utility service. All of these works fine and also logs information and errors using a logback.xml. This then generates a .log file.

Now, I've read that I should use a splunk logback appender in my current logback.xml so as I can send data to my splunk server (which is hosted via virtual box) every time I try to make a request inside my send-data-service. Although I can't actually make it work. I've already setup a HEC inside splunk but it still does not receive any data. My goal is to send the whole .log file to my splunk server.

This is the content of my logback.xml:

<appender name="http"
            class="com.splunk.logging.HttpEventCollectorLogbackAppender">
            <url>http://localhost:8089</url>
            <token>$token-generated$</token>
            <source>send-data-service</source>
            <sourcetype>logback</sourcetype>
            <messageFormat>text</messageFormat>
            <middleware>HttpEventCollectorUnitTestMiddleware</middleware>
            <layout class="ch.qos.logback.classic.PatternLayout">
                <pattern>%logger: %msg%n</pattern>
            </layout>
        </appender>

        <logger name="splunk.logger" additivity="false" level="INFO">
            <appender-ref ref="http" />
        </logger

I would just also like to ask if i'm using a proper approach? I'm just new in using splunk and I'm really quite lost. Hope anyone can help me with this. Thank you!

Labels (2)
0 Karma

igiannop
New Member

I have exactly the same issue with logback. I have defined sourcetype as logback. Do we have any solution about it ?

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...