Page History

...

The Splunk component provides access to Splunk using , via the Splunk provided client api, and it enables Rest API, allowing you to publish and search for events in Splunk.

Maven users will need to add the following dependency to their their pom.xml for this component:

	<dependency>
    	<groupId>org.apache.camel</groupId>
    	<artifactId>camel-splunk</artifactId>
    	<version>${camel-version}</version>
	</dependency>

URI

...

Format

  splunk://[endpoint]?[options]

Producer Endpoints

...

Div
class confluenceTableSmall
Endpoint Description stream Streams data to a named index, or the default index if not specified. When using stream mode be aware of that Splunk has some internal buffer (about 1MB or so) before events gets to the index. If you need realtime, better use use submit or or tcp mode. submit submit mode. Uses Splunk rest api 's Rest API to publish events to a named index, or the default if not specified. tcp tcp mode. Streams data to a tcp TCP port, and requires a open receiver port in Splunk.

When publishing events the message body should contain a SplunkEvent.   See comment under message bodySee later.

Example

Code Block
language java
from("direct:start") .convertBodyTo(SplunkEvent.class) .to("splunk://submit?username=user&password=123&index=myindex&sourceType=someSourceType&source=mySource")...;

In this example a converter is required to convert to a a SplunkEvent class.

Consumer Endpoints

...

Div
class confluenceTableSmall
Endpoint Description normal Performs normal search and requires a search query in the search option. savedsearch Performs search based on a search query saved in splunk Splunk and requires the name of the query in the the savedSearch option.

Example

Code Block
language java
from("splunk://normal?delay=5s&username=user&password=123&initEarliestTime=-10s&search=search index=myindex sourcetype=someSourcetype") .to("direct:search-result");

camel-splunk creates a route exchange per search result with a an instance of org.apache.camel.component.splunk.event.SplunkEvent in the body.

URI Options

...

Message Body

Splunk operates on data in key/value pairs. The The SplunkEvent class is a placeholder for such data, and should be in the message body
for the producer. Likewise it will be returned in the body per search result for the consumer.

As of From Camel 2.16.0 you can send raw data to Splunk by setting the setting raw option =true on the producer endpoint. This is useful for ege.g., json/xml and other payloads where Splunk has build in support. 

...

Search Twitter for tweets with music and publish events to Splunk

      from("twitter://search?type=polling&keywords=music&delay=10&consumerKey=abc&consumerSecret=def&accessToken=hij&accessTokenSecret=xxx")
          .convertBodyTo(SplunkEvent.class)
          .to("splunk://submit?username=foo&password=bar&index=camel-tweets&sourceType=twitter&source=music-tweets");

To convert a Tweet to a a SplunkEvent you could use a converter like:

@Converter
public class Tweet2SplunkEvent {
    @Converter
    public static SplunkEvent convertTweet(Status status) {
        SplunkEvent data = new SplunkEvent("twitter-message", null);
        //data.addPair("source", status.getSource());
        data data.addPair("from_user", status.getUser().getScreenName());
        data.addPair("in_reply_to", status.getInReplyToScreenName());
        data.addPair(SplunkEvent.COMMON_START_TIME, status.getCreatedAt());
        data.addPair(SplunkEvent.COMMON_EVENT_ID, status.getId());
        data.addPair("text", status.getText());
        data.addPair("retweet_count", status.getRetweetCount());
    
    if    if (status.getPlace() != null) {
            data.addPair("place_country", status.getPlace().getCountry());
            data.addPair("place_name", status.getPlace().getName());
            data.addPair("place_street", status.getPlace().getStreetAddress());
        }
       
        if (status.getGeoLocation() != null) {
            data.addPair("geo_latitude", status.getGeoLocation().getLatitude());
            data.addPair("geo_longitude", status.getGeoLocation().getLongitude());
        }
       
        return data;
    }
}

Search Splunk for tweets:

      from("splunk://normal?username=foo&password=bar&initEarliestTime=-2m&search=search index=camel-tweets sourcetype=twitter")
          .log("${body}");

...

Comments

Splunk comes with a variety of options for leveraging machine generated data with prebuilt pre-built apps for analyzing and displaying this.
For example the jmx JMX app. could be used to publish jmx JMX attributes, ege.g., route and jvm JVM metrics to Splunk, and displaying this on a dashboard.

...