Splunk HEC

Since Camel 3.3

Only producer is supported

The Splunk HEC component allows to send data to Splunk using the HTTP Event Collector.

Maven users will need to add the following dependency to their pom.xml for this component:

 <dependency>
        <groupId>org.apache.camel</groupId>
        <artifactId>camel-splunk-hec</artifactId>
        <version>${camel-version}</version>
</dependency>

URI format

  splunk-hec:[endpoint]/[token]?[options]

The Splunk HEC component supports 2 options, which are listed below.

Name Description Default Type

lazyStartProducer (producer)

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

boolean

autowiredEnabled (advanced)

Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.

true

boolean

The Splunk HEC endpoint is configured using URI syntax:

splunk-hec:splunkURL/token

with the following path and query parameters:

Path Parameters (2 parameters):

Name Description Default Type

splunkURL

Required Splunk Host URL

String

token

Required Splunk authorization token

String

Query Parameters (8 parameters):

Name Description Default Type

host (producer)

Splunk host.

String

index (producer)

Splunk index to write to

camel

String

lazyStartProducer (producer)

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

boolean

source (producer)

Splunk source argument

camel

String

sourceType (producer)

Splunk sourcetype argument

camel

String

synchronous (advanced)

Sets whether synchronous processing should be strictly used, or Camel is allowed to use asynchronous processing (if supported).

false

boolean

https (security)

Contact HEC over https.

true

boolean

skipTlsVerify (security)

Splunk HEC TLS verification.

false

boolean

Message body

The body must be serializable to JSON so it may be sent to Splunk.

A String or a java.util.Map object can be serialized easily.

Use Cases

The Splunk HEC endpoint may be used to stream data to Splunk for ingestion.

It is meant for high volume ingestion of machine data.

Spring Boot Auto-Configuration

When using splunk with Spring Boot make sure to use the following Maven dependency to have support for auto configuration:

<dependency>
  <groupId>org.apache.camel.springboot</groupId>
  <artifactId>camel-splunk-starter</artifactId>
  <version>x.x.x</version>
  <!-- use the same version as your Camel core version -->
</dependency>

The component supports 5 options, which are listed below.

Name Description Default Type

camel.component.splunk.autowired-enabled

Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.

true

Boolean

camel.component.splunk.bridge-error-handler

Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions occurred while the consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored.

false

Boolean

camel.component.splunk.enabled

Whether to enable auto configuration of the splunk component. This is enabled by default.

Boolean

camel.component.splunk.lazy-start-producer

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

Boolean

camel.component.splunk.splunk-configuration-factory

To use the SplunkConfigurationFactory. The option is a org.apache.camel.component.splunk.SplunkConfigurationFactory type.

SplunkConfigurationFactory
Back to top