Splunk Logging for Java

Version 1.11.8

Splunk logging for Java enables you to log events to HTTP Event Collector or to a TCP input on a Splunk Enterprise instance within your Java applications. You can use three major Java logging frameworks: Logback, Log4j 2, and java.util.logging. Splunk logging for Java is also enabled for Simple Logging Facade for Java (SLF4J).

Splunk logging for Java provides:

Appender classes that package events into the proper format for the input type you're using (HTTP Event Collector or TCP).
Handler classes that export the logging events.
An optional error handler to catch failures for HTTP Event Collector events.
Example configuration files for all three frameworks that show how to configure the frameworks to write to HTTP Event Collector or TCP ports.
Support for batching events (sent to HTTP Event Collector only).

Requirements

Here's what you need to get going with Splunk logging for Java.

Splunk

If you haven't already installed Splunk, download it here. For more about installing and running Splunk and system requirements, see Installing & Running Splunk. Splunk logging for Java is tested with Splunk Enterprise 8.0 and 8.2.0.

Java

You'll need Java version 8 or higher, from OpenJDK or Oracle.

Logging frameworks

If you're using the Log4j 2, Simple Logging Facade for Java (SLF4J), or Logback logging frameworks in conjunction with Splunk logging for Java there are additional compatibility requirements. For more about logging framework requirements, see Enable logging to HEC and Enable logging to TCP inputs. These frameworks require:

Log4j version 2.17.2
SLF4J version 1.7.36
Logback version 1.2.11

Documentation and resources

For more information about installing and using Splunk logging for Java, see Overview of Splunk logging for Java.
For reference documentation, see the Splunk logging for Java API reference.
For all things developer with Splunk, see the Splunk Developer Portal.
For more about about Splunk in general, see Splunk>Docs.

Dependency Management

The splunk-library-javalogging artifact can be accessed via Splunk's managed Maven repoitory.

Apache Maven

First define the repository as follows

...
  <repositories>
    <repository>
        <id>splunk-artifactory</id>
        <name>Splunk Releases</name>
        <url>https://splunk.jfrog.io/splunk/ext-releases-local</url>
    </repository>
  </repositories>
...

... then reference the dependency as follows

...
  <dependencies>
    <dependency>
      <groupId>com.splunk.logging</groupId>
      <artifactId>splunk-library-javalogging</artifactId>
      <version>${latest.version}</version>
    </dependency>
    ...
  </dependencies>
...

The above can be adapted to suit Other dependency management implementations as necessary.

License

Splunk logging for Java is licensed under the Apache License 2.0.

See the LICENSE file for details.

Contributions

Get the Splunk Java Logging Framework from GitHub and clone the resources to your computer. For example, use the following command:

git clone https://github.com/splunk/splunk-library-javalogging.git

Support

The Splunk logging for Java is community-supported.

You can find help through our community on Splunk Answers (use the "logging-library-java" tag to identify your questions).
File issues on GitHub.