Logs are printed in console, but not getting pushed to Splunk Server

[VinayakJamadar]

Logs are printed correctly in console, but not getting pushed to Splunk Server.

And not even printing any error.

Below is my log4j2.xml configuration file

<?xml version="1.0" encoding="UTF-8"?> <Configuration status="info" name="example" packages="org.example"> <Appenders> <Console name="console" target="SYSTEM_OUT"> <PatternLayout pattern="%style{%d{ISO8601}} %highlight{%-5level }[%style{%t}{bright,blue}] %style{%C{10}}{bright,yellow}: %msg%n%throwable" /> </Console> <File name="MyFile" fileName="logs/app.log"> <PatternLayout> <Pattern>%d %p %c{1.} [%t] %m%n</Pattern> </PatternLayout> </File> <SplunkHttp name="httpconf" url="http://localhost:8088" token="b489e167-d96d-46ec-922f-6b25fc83f199" host="localhost" index="spring_dev" source="source name" sourcetype="log4j" messageFormat="text" disableCertificateValidation="true"> <PatternLayout pattern="%m" /> </SplunkHttp> </Appenders>

<Loggers>
    <Root level="info">
        <AppenderRef ref="console" />
        <AppenderRef ref="MyFile"/>
        <AppenderRef ref="httpconf" />
    </Root>
</Loggers>

[underhill]

I'm seeing the same problem. Logs print to console and written to file but nothing in Splunk. I fired up tcpdump and can see packets going to the HEC endpoint. The heavy forwarder shows no errors and nothing in the index. Also verified HEC is working with curl.
Using log4j v2.33.1 and splunk javalogging 1.11.8.

[BrianErikCobb]

I encountered a similar issue when upgrading to Java 17 and Splunk Logger 1.11.8. In my case, the fix was to add the "index" attribute to the SplunkHttp configuration. This issue didn’t occur when making calls using curl, but it did surface in this context.

I noticed that the OP has already added the "index" attribute, but for anyone else facing a similar problem, including the "index" attribute resolved it for me. To diagnose the issue, I ran the library through JUnit tests and logged the HEC (HTTP Event Collector) HTTP response, which revealed that the root cause was the missing "index" attribute.

I recommend following a similar approach—use JUnit to test and inspect the HEC HTTP response—as Splunk may be returning an error related to this configuration.