CDN logs not forwarded to Splunk in Adobe Experience Manager Production
This article describes how to address an issue where CDN logs from the Adobe Experience Manager (AEM) Production environment aren’t appearing in Splunk due to an incorrect Splunk HEC token configuration.
Description description
Environment
- Adobe Experience Manager (AEM) Production environment
- Splunk log forwarding integration
Symptoms
- CDN logs from the AEM Production environment aren’t visible in Splunk.
- Log forwarding works as expected in the Stage environment.
- AEM logs are present in Splunk for both environments, but CDN logs are missing only in Production.
- Errors in the CDN logging service indicate that Splunk is rejecting log events due to an incorrect index.
Cause
The Splunk HEC token configured for the Production environment doesn’t have permission to write to the Production log index, resulting in rejected log events.
Resolution resolution
Follow the steps below to resolve the issue:
-
Update the Splunk HEC token for the Production environment:
-
Access your Cloud Manager program and select the Production environment.
-
Open the pipeline secrets section and locate the entry for the Splunk HEC token.
-
Replace the current value with the correct Splunk HEC token that has permission to write to the Production log index.
-
Save your changes and redeploy, or trigger a deployment that applies the updated secrets.
-
-
Confirm Splunk index setup:
-
In Splunk, verify that the Production log index exists and is configured to accept data from the updated token.
-
Ensure the token used in the Production environment has permission to write to this index.
-
-
Validate log forwarding:
-
After updating the token and redeploying, generate test traffic through the Production CDN.
-
In Splunk, search for recent CDN log entries in the Production log index to confirm that logs are now being forwarded successfully.
-