Splunk HEC

Since Camel 3.3

Only producer is supported

The Splunk HEC component allows to send data to Splunk using the HTTP Event Collector.

Maven users will need to add the following dependency to their pom.xml for this component:

 <dependency>
        <groupId>org.apache.camel</groupId>
        <artifactId>camel-splunk-hec</artifactId>
        <version>${camel-version}</version>
</dependency>

URI format

  splunk-hec:[endpoint]/[token]?[options]

The Splunk HEC component supports 2 options, which are listed below.

Name Description Default Type

lazyStartProducer (producer)

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

boolean

autowiredEnabled (advanced)

Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.

true

boolean

The Splunk HEC endpoint is configured using URI syntax:

splunk-hec:splunkURL/token

with the following path and query parameters:

Path Parameters (2 parameters):

Name Description Default Type

splunkURL

Required Splunk Host URL

String

token

Required Splunk authorization token

String

Query Parameters (10 parameters):

Name Description Default Type

bodyOnly (producer)

Send only the message body

false

boolean

headersOnly (producer)

Send only message headers

false

boolean

host (producer)

Splunk host.

String

index (producer)

Splunk index to write to

camel

String

lazyStartProducer (producer)

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

boolean

source (producer)

Splunk source argument

camel

String

sourceType (producer)

Splunk sourcetype argument

camel

String

time (producer)

Time this even occurred. By default, the time will be when this event hits the splunk server.

Long

https (security)

Contact HEC over https.

true

boolean

skipTlsVerify (security)

Splunk HEC TLS verification.

false

boolean

Message Headers

Name Type Description

SplunkHECConstants.INDEX_TIME

Long

Epoch-formatted time. Specify with the time query string parameter. Sets a default for all events in the request. The default time can be overridden.

Message body

The body must be serializable to JSON so it may be sent to Splunk.

A String or a java.util.Map object can be serialized easily.

Use Cases

The Splunk HEC endpoint may be used to stream data to Splunk for ingestion.

It is meant for high volume ingestion of machine data.

Configuring the index time

By default, the index time for an event is when the event makes it to the Splunk server.

from("direct:start")
        .to("splunk-hec://localhost:8080?token");

If you are ingesting a large enough dataset with a big enough lag then the time the event hits the server and when that event actually happened could be skewed. If you want to override the index time you can do so.

from("kafka:logs")
        .setHeader(SplunkHECConstants.INDEX_TIME, simple("${headers[kafka.HEADERS].lastKey('TIME')}"))
        .to("splunk-hec://localhost:8080/token");
from("kafka:logs")
        .toD("splunk-hec://localhost:8080/token?time=${headers[kafka.HEADERS].lastKey('TIME')}");

Spring Boot Auto-Configuration

When using splunk with Spring Boot make sure to use the following Maven dependency to have support for auto configuration:

<dependency>
  <groupId>org.apache.camel.springboot</groupId>
  <artifactId>camel-splunk-starter</artifactId>
  <version>x.x.x</version>
  <!-- use the same version as your Camel core version -->
</dependency>

The component supports 5 options, which are listed below.

Name Description Default Type

camel.component.splunk.autowired-enabled

Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.

true

Boolean

camel.component.splunk.bridge-error-handler

Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions occurred while the consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored.

false

Boolean

camel.component.splunk.enabled

Whether to enable auto configuration of the splunk component. This is enabled by default.

Boolean

camel.component.splunk.lazy-start-producer

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

Boolean

camel.component.splunk.splunk-configuration-factory

To use the SplunkConfigurationFactory. The option is a org.apache.camel.component.splunk.SplunkConfigurationFactory type.

SplunkConfigurationFactory
Back to top