Splunk
Skip to end of metadata
Go to start of metadata

Splunk Component

Available as of Camel 2.13

The Splunk component provides access to Splunk using the Splunk provided client api, and it enables you to publish and search for events in Splunk.

Maven users will need to add the following dependency to their pom.xml for this component:

URI format

Producer Endpoints:

Endpoint

Description

stream

Streams data to a named index or the default if not specified.
When using stream mode be aware of that Splunk has some internal buffer (about 1MB or so) before events gets to the index.
If you need realtime, better use submit or tcp mode.

submit

submit mode. Uses Splunk rest api to publish events to a named index or the default if not specified.

tcp

tcp mode. Streams data to a tcp port, and requires a open receiver port in Splunk.

When publishing events the message body should contain a SplunkEvent.

Example

In this example a converter is required to convert to a SplunkEvent class.

Consumer Endpoints:

Endpoint

Description

normal

Performs normal search and requires a search query in the search option.

savedsearch

Performs search based on a search query saved in splunk and requires the name of the query in the savedSearch option.

Example

camel-splunk creates a route exchange per search result with a SplunkEvent in the body.

URI Options

Name

Default Value

Context

Description

host

localhost

Both

Splunk host.

port

8089

Both

Splunk port

username

null

Both

Username for Splunk

password

null

Both

Password for Splunk

connectionTimeout

5000

Both

Timeout in MS when connecting to Splunk server

useSunHttpsHandler

false

Both

Use sun.net.www.protocol.https.Handler Https hanlder to establish the Splunk Connection.
Can be useful when running in application servers to avoid app. server https handling.

index

null

Producer

Splunk index to write to

sourceType

null

Producer

Splunk sourcetype arguement

source

null

Producer

Splunk source arguement

tcpReceiverPort

0

Producer

Splunk tcp receiver port when using tcp producer endpoint.

initEarliestTime

null

Consumer

Initial start offset of the first search. Required

earliestTime

null

Consumer

Earliest time of the search time window.

latestTime

null

Consumer

Latest time of the search time window.

count

0

Consumer

A number that indicates the maximum number of entities to return.
Note this is not the same as maxMessagesPerPoll which currently is unsupported

search

null

Consumer

The Splunk query to run

savedSearch

null

Consumer

The name of the query saved in Splunk to run

Message body

Splunk operates on data in key/value pairs. The SplunkEvent class is a placeholder for such data, and should be in the message body
for the producer. Likewise it will be returned in the body per search result for the consumer.

Use Cases

Search Twitter for tweets with music and publish events to Splunk

To convert a Tweet to a SplunkEvent you could use a converter like

Search Splunk for tweets

Other comments

Splunk comes with a variety of options for leveraging machine generated data with prebuilt apps for analyzing and displaying this.
For example the jmx app. could be used to publish jmx attributes, eg. route and jvm metrics to Splunk, and displaying this on a dashboard.

See Also

Labels
  • No labels