Getting Data In

Why is WebLogic server.out parsing not working?

cmeerbeek
Path Finder

Hi all,

I have a Splunk installation here with lot's or Oracle WebLogic logging.
Everything except the *server.out files are working great but whatever I do I cannot get it to work properly for those files.

My current props.conf is:

LINE_BREAKER=([\n\r]+)<\w{3}\s\d{1,2},\s\d{4}\s\d{1,2}:\d{1,2}:\d{1,2}\s\w{2}\s\w+>
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=false
TIME_FORMAT=%b %d, %Y %I:%M:%S %P %Z
TIME_PREFIX=^<
TRUNCATE=999999

This works fine when I manually use the data upload via the webui but it is not working from the UF.
Any advice on this?
How does WebLogic write data to this file?

My next step is looking at time_before_close but that is the last resort.

0 Karma

woodcock
Esteemed Legend

If you are using UF, then you need to deploy these configurations to the Indexers or switch your UF to HF. Those kinds of props.conf configurations are executed by the first Splunk server that cooks the data which is almost always the first Heavy Forwarder or Indexer. Once deployed to the proper Splunk server(s), all Splunk instances will need to be restarted. Then, only verify on events that have been forwarded in AFTER these restarts (you can use _index_earliest=-2m); older events will stay broken.

0 Karma

cmeerbeek
Path Finder

Parsing is happening on the HF. I know that the UF can't do that. Sorry for not mentioning this.

0 Karma

felipesewaybric
Contributor

The UF(light forwarder) can't use props.conf, you need to use with a Heavy Forwarder

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...