Deployment Architecture

Streaming with Log4J to Multiple Indexers

ezajac
Path Finder

We are looking to use Log4J to stream log files to Splunk Indexers. In my Splunk environment I have three Splunk Indexers. I found configurations that can be used for non clustered Splunk Environment.
I have other servers that use a forwarder with a Splunk Indexing Group configured.

What modifications are needed Log4J Appender to write to multiple indexers the way that the Splunk Forwarders stream log files?

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion

Log4J doesn't have Load Balancing appenders , so you couldn't achieve this functionality , unless you wrote your own custom load balancing appender.

You could however setup multiple appender definitions in your log4j config file that write to multiple indexers (although this could result in duplicated data if your indexers are in a cluster)

Also , have you seen the Splunk logging appenders for Log4J ? There are Raw TCP and REST Appenders for Splunk. Also , some of the functionality of the Splunk Universal Forwarder is mimicked ie: data queueing and auto reconnect upon connectivity errors to the Splunk Indexer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...