Jira Application Log Regex for Field Extractions in Splunk

[zellerm]

Hi There,

We have the logs from Confluence and Jira through the Splunk Universal Forwarder available in Splunk.

BUT why are the atlassian-jira.logs so much different from the atlassian-confluence.logs in regards of the format?

The real power of Splunk reveals when one can use field extractions.

We have a good succes with Confluence but Jira is nearly impossible as the format of the log changes regarding the method which writes the logs.

Why is there a difference in format between Jira and Confluence atlassian-*.log?

Is there anyone who managed to write a propriate regex for field extractions ?

Thanks in advance,
Martin