Deployment Architecture

Streaming with Log4J to Multiple Indexers

ezajac
Path Finder

We are looking to use Log4J to stream log files to Splunk Indexers. In my Splunk environment I have three Splunk Indexers. I found configurations that can be used for non clustered Splunk Environment.
I have other servers that use a forwarder with a Splunk Indexing Group configured.

What modifications are needed Log4J Appender to write to multiple indexers the way that the Splunk Forwarders stream log files?

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion

Log4J doesn't have Load Balancing appenders , so you couldn't achieve this functionality , unless you wrote your own custom load balancing appender.

You could however setup multiple appender definitions in your log4j config file that write to multiple indexers (although this could result in duplicated data if your indexers are in a cluster)

Also , have you seen the Splunk logging appenders for Log4J ? There are Raw TCP and REST Appenders for Splunk. Also , some of the functionality of the Splunk Universal Forwarder is mimicked ie: data queueing and auto reconnect upon connectivity errors to the Splunk Indexer.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...