Getting Data In

Splunk Add-on for Tomcat pattern not working

_joe
Contributor

Hello all,

I was wondering if I could please get some suggestions on why Tomcat isn't honoring my pattern values. I am following the instructions here:  https://docs.splunk.com/Documentation/AddOns/released/Tomcat/Recommendedfields

As recommended by Splunk documentation, we setup the following in className="org.apache.catalina.valves.AccessLogValve " in of server.xml

prefix="localhost_access_log_splunk" suffix=".txt"
pattern="%t, x_forwarded_for=?%{X-Forwarded-For}i?, remote_ip=?%a?,....

The filename and fields log as expected.


The only issue is instead of quotation (") marks, I am just seeing question marks (i.e. ...x_forwarded_for=?-?, remote_ip=?1.2.3.1?, remote_host=?1.2.3.2?,..)

Splunk Add-on for Tomcat: https://splunkbase.splunk.com/app/2911/

 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

How did you input those settings? Quotes are notorious for being "the wrong ones", especially when copy-pasted from an unknown source.

0 Karma

MuratKuru
Explorer

I have the same problem.
Where you able to solve this issue? 

0 Karma

_joe
Contributor

Sorry, not really. It seems some Tomcat instances need to be escaped by something different, I'm no sure why. 

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...