How do I flush everything to Splunk?

[johncurrier]

When writing an AWS Lambda I need to know that all of my logs have been persisted to Splunk before exiting the Lambda. The Lambdas that I'm working on aren't customer-facing, so their performance isn't time critical.

I'm currently setting batch_size_count to 1. My understanding is that any value higher than that could result in a batch never being persisted to Splunk.

At the end of my Lambda I don't seem to have a way of knowing that all of my log entries have been persisted since they seem to be done asynchronously. How do I know that everything has been flushed so I can return control of the Lambda back to AWS? Note that shutdown hooks don't seem to be applicable in the AWS Lambda world.

[sleepo581]

I use the following work-around with Logback (assuming there is logger called root and appender called SPLUNK_HEC):

private static void flushLogs() {
        LoggerContext loggerContext = (LoggerContext) LoggerFactory.getILoggerFactory();
        HttpEventCollectorLogbackAppender<?> appender = (HttpEventCollectorLogbackAppender<?>) loggerContext.getLogger("root").getAppender("SPLUNK_HEC");
        if (appender != null) {
            appender.flush();
        }
    }