SplunkJavaLogging

Damien DallimoreDeveloper Evangelist

Copyright © 2013, Splunk Inc.2

Background• Sometimes you can’t deploy a Splunk Forwarder to collect logs,

although this is certainly a best practice

• Sometimes you have disk constraints for writing logs

• Wouldn’t it be nice to send your log events from your code directly to Splunk ?

• Sure , Splunk can eat any text logs , but we should be educating our developers about the value in best practice semantic logging

Copyright © 2013, Splunk Inc.

SplunkJavaLogging

3

• A logging framework to allow developers to as seamlessly as possible integrate Splunk best practice logging semantics into their code

• Transport log events to Splunk directly from your code• Custom handler/appender implementations(REST and Raw TCP) for common

Java logging frameworks . • LogBack• Log4j (Log4j2 coming also)• java.util.logging

• Utility classes for formatting log events• Configurable in memory buffer to handle network outages

Copyright © 2013, Splunk Inc.

Developers just log as they are used to

4

2012-08-07 15:54:06:644+1200 name="Failed Login" event_id="someID" app="myapp" user="jane" somefieldname="foobar"

Better

A-HA

Copyright © 2013, Splunk Inc.

Logging Framework takes care of the Splunk transport , REST or Raw TCP

5

Copyright © 2013, Splunk Inc.

<barf>Typical Java Stacktraces in logs</barf>

6

Copyright © 2013, Splunk Inc.

SplunkJavaLogging is your friend

7

Copyright © 2013, Splunk Inc.

Java Stacktraces in Splunk

8

Demo

Copyright © 2013, Splunk Inc.10

Contact me

Email : ddallimore@splunk.comTwitter : @damiendallimoreSkype : damien.dallimoreGithub : damiendallimoreSplunkbase : damiendSlideshare : http://www.slideshare.net/damiendallimore Blogs : http://blogs.splunk.com/devWeb : http://dev.splunk.com