Getting Data In

Reading log4j from syslog files

gerasalus
New Member

Hi all,

testing out Splunk, and wondering is there some kind of out-of-the-box solution to correctly process syslog files that were created from log4j SyslogAppender?

I've tried to follow the guide http://wiki.splunk.com/Community:StripSyslog, but unfortunetally it does not work.

I'm using log pattern specified in http://wiki.apache.org/logging-log4j/syslog :

%t %5r %-5p %-21d{yyyyMMdd HH:mm:ss,SSS} %c{2} [%x] %m %n

Should i use another pattern?

Note: i do not want to log directly from log4j to splunk, i want splunk to read from syslog.
Are there any working solutions?

Tags (3)
0 Karma

joshd
Builder

I strayed away from using the syslogappender and just installed universal forwarders where ever the log4j data was that I wanted to get at, just made things a bit cleaner. Whats your hesitation? why the need to read from syslog?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...