Some log entries missing

[enisspahi]

Hi,

I am using SplunkHttp appender with log4j2 for my Java console application. In case I am using batch mode (any batch_size_count bigger than 1) some of my entries logged before the shutdown are missing on splunk. For instance I expect to see [INFO ] 2023-12-11 11:35:27.626 [main] ExitCodePrinter - Application finished with exit code=1 but no luck.

The same application has console and file appenders and the log entry is not missing in console and log file.

This is my setup. Dependency: com.splunk.logging:splunk-library-javalogging:1.11.8. Log4j2 file:

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="info" name="example" packages="com.splunk.logging">

    <Appenders>

        <SplunkHttp name="http"
                    url="***"
                    token="***"
                    index="***"
                    host="***"
                    sourcetype="log4j"
                    source="***"
                    messageformat="json">
            <errorCallback>com.splunk.logging.util.StandardErrorCallback</errorCallback>
            <JSONLayout compact="true" eventEol="true" stacktraceAsString="true" />
        </SplunkHttp>

        <File name="logfile" fileName="****" createOnDemand="true">
            <PatternLayout pattern="******"/>
        </File>

        <Console name="console" target="SYSTEM_OUT" follow="true">
            <PatternLayout pattern="***" />
        </Console>

    </Appenders>
    <Loggers>
        <Root level="INFO">
            <AppenderRef ref="console"/>
            <AppenderRef ref="logfile"/>
            <AppenderRef ref="http"/>
        </Root>
    </Loggers>

</Configuration>

This issue forces me to use batch_size_count=1 so that I don't loose some important logs. Would be nice being able to use batching due to performance reasons.

[VinayakJamadar]

@enisspahi

In my case logs are only being printed in console, but not pushing logs to Splunk

Here is my log4j2.xml configuration file

`<?xml version="1.0" encoding="UTF-8"?>

%d %p %c{1.} [%t] %m%n `

Please help

Also, can you share the Dependency of splunk-library-javalogging:1.11.8