...
Code Block |
---|
splunk://[endpoint]?[options]
|
Producer Endpoints:
Div |
---|
class | confluenceTableSmall |
---|
|
Endpoint | Description |
---|
stream | Streams data to a named index or the default if not specified. When using stream mode be aware of that Splunk has some internal buffer (about 1MB or so) before events gets to the index. If you need realtime, better use submit or tcp mode. | submit | submit mode. Uses Splunk rest api to publish events to a named index or the default if not specified. | tcp | tcp mode. Streams data to a tcp port, and requires a open receiver port in Splunk. |
|
Wiki Markup |
---|
{div:class=confluenceTableSmall}
|| Endpoint || Description
| stream | Streams data to a named index or the default if not specified.
When using stream mode be aware of that Splunk has some internal buffer (about 1MB or so) before events gets to the index.
If you need realtime, better use submit or tcp mode. |
| submit | submit mode. Uses Splunk rest api to publish events to a named index or the default if not specified. |
| tcp | tcp mode. Streams data to a tcp port, and requires a open receiver port in Splunk.|
{div} |
When publishing events the message body should contain a SplunkEvent.
...
In this example a converter is required to convert to a SplunkEvent class.
Consumer Endpoints:
Div |
---|
class | confluenceTableSmall |
---|
|
Endpoint | Description |
---|
normal | Performs normal search and requires a search query in the search option. | savedsearch | Performs search based on a search query saved in splunk and requires the name of the query in the savedSearch option. |
|
Wiki Markup |
---|
{div:class=confluenceTableSmall}
|| Endpoint || Description
|normal | Performs normal search and requires a search query in the search option.
|savedsearch| Performs search based on a search query saved in splunk and requires the name of the query in the savedSearch option.
{div} |
Example
Code Block |
---|
|
from("splunk://normal?delay=5s&username=user&password=123&initEarliestTime=-10s&search=search index=myindex sourcetype=someSourcetype")
.to("direct:search-result");
|
camel-splunk creates a route exchange per search result with a SplunkEvent in the body.
URI Options
Div |
---|
class | confluenceTableSmall |
---|
|
Name | Default Value | Context | Description |
---|
host | localhost | Both | Splunk host. | port | 8089 | Both | Splunk port | username | null | Both | Username for Splunk | password | null | Both | Password for Splunk | connectionTimeout | 5000 | Both | Timeout in MS when connecting to Splunk server | useSunHttpsHandler | false | Both | Use |
|
Wiki Markup |
---|
{div:class=confluenceTableSmall}
|| Name || Default Value || Context || Description ||
|host | localhost | Both | Splunk host.
|port | 8089 | Both | Splunk port
| username | null | Both | Username for Splunk
| password | null | Both | Password for Splunk
| connectionTimeout | 5000 | Both | Timeout in MS when connecting to Splunk server
| useSunHttpsHandler | false | Both | Use sun.net.www.protocol.https.Handler |
| index | null | Producer | Splunk index to write to
| sourceType | null | Producer | Splunk sourcetype arguement
| source | null | Producer | Splunk source arguement
| tcpReceiverPort | 0 | Producer | Splunk tcp receiver port when using tcp producer endpoint.
| initEarliestTime | null | Consumer | Initial start offset of the first search. Required
| earliestTime | null | Consumer | Earliest time of the search time window.
| latestTime | null | Consumer | Latest time of the search time window.
| count | 0 | Consumer | A number that indicates the maximum number of entities to return.
Note this is not the same as maxMessagesPerPoll which currently is unsupported
| search | null | Consumer | The Splunk query to run
| savedSearch | null | Consumer | The name of the query saved in Splunk to run
| streaming | false | Consumer | *Camel 2.14.0* : Stream exchanges as they are received from Splunk, rather than returning all of them in one batch. This has the benefit of receiving results faster, as well as requiring less memory as exchanges aren't buffered in the component.
{div} | index | null | Producer | Splunk index to write to | sourceType | null | Producer | Splunk sourcetype arguement | source | null | Producer | Splunk source arguement | tcpReceiverPort | 0 | Producer | Splunk tcp receiver port when using tcp producer endpoint. | initEarliestTime | null | Consumer | Initial start offset of the first search. Required | earliestTime | null | Consumer | Earliest time of the search time window. | latestTime | null | Consumer | Latest time of the search time window. | count | 0 | Consumer | A number that indicates the maximum number of entities to return. Note this is not the same as maxMessagesPerPoll which currently is unsupported | search | null | Consumer | The Splunk query to run | savedSearch | null | Consumer | The name of the query saved in Splunk to run | streaming | false | Consumer | Camel 2.14.0 : Stream exchanges as they are received from Splunk, rather than returning all of them in one batch. This has the benefit of receiving results faster, as well as requiring less memory as exchanges aren't buffered in the component. |
|
Message body
Splunk operates on data in key/value pairs. The SplunkEvent class is a placeholder for such data, and should be in the message body
for the producer. Likewise it will be returned in the body per search result for the consumer.
...