Splunk HEC

Since Camel 3.3

Only producer is supported

The Splunk HEC component allows to send data to Splunk using the HTTP Event Collector.

Maven users will need to add the following dependency to their pom.xml for this component:

<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-splunk-hec</artifactId>
    <version>${camel-version}</version>
</dependency>

URI format

splunk-hec:[endpoint]/[token]?[options]

Configuring Options

Camel components are configured on two separate levels:

  • component level

  • endpoint level

Configuring Component Options

The component level is the highest level which holds general and common configurations that are inherited by the endpoints. For example a component may have security settings, credentials for authentication, urls for network connection and so forth.

Some components only have a few options, and others may have many. Because components typically have pre configured defaults that are commonly used, then you may often only need to configure a few options on a component; or none at all.

Configuring components can be done with the Component DSL, in a configuration file (application.properties|yaml), or directly with Java code.

Configuring Endpoint Options

Where you find yourself configuring the most is on endpoints, as endpoints often have many options, which allows you to configure what you need the endpoint to do. The options are also categorized into whether the endpoint is used as consumer (from) or as a producer (to), or used for both.

Configuring endpoints is most often done directly in the endpoint URI as path and query parameters. You can also use the Endpoint DSL as a type safe way of configuring endpoints.

A good practice when configuring options is to use Property Placeholders, which allows to not hardcode urls, port numbers, sensitive information, and other settings. In other words placeholders allows to externalize the configuration from your code, and gives more flexibility and reuse.

The following two sections lists all the options, firstly for the component followed by the endpoint.

Component Options

The Splunk HEC component supports 2 options, which are listed below.

Name Description Default Type

lazyStartProducer (producer)

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

boolean

autowiredEnabled (advanced)

Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.

true

boolean

Endpoint Options

The Splunk HEC endpoint is configured using URI syntax:

splunk-hec:splunkURL/token

with the following path and query parameters:

Path Parameters (2 parameters)

Name Description Default Type

splunkURL (producer)

Required Splunk Host URL.

String

token (security)

Required Splunk authorization token.

String

Query Parameters (10 parameters)

Name Description Default Type

bodyOnly (producer)

Send only the message body.

false

boolean

headersOnly (producer)

Send only message headers.

false

boolean

host (producer)

Splunk host.

String

index (producer)

Splunk index to write to.

camel

String

lazyStartProducer (producer)

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

boolean

source (producer)

Splunk source argument.

camel

String

sourceType (producer)

Splunk sourcetype argument.

camel

String

time (producer)

Time this even occurred. By default, the time will be when this event hits the splunk server.

Long

https (security)

Contact HEC over https.

true

boolean

skipTlsVerify (security)

Splunk HEC TLS verification.

false

boolean

Message Headers

Name Type Description

SplunkHECConstants.INDEX_TIME

Long

Epoch-formatted time. Specify with the time query string parameter. Sets a default for all events in the request. The default time can be overridden.

Message body

The body must be serializable to JSON so it may be sent to Splunk.

A String or a java.util.Map object can be serialized easily.

Use Cases

The Splunk HEC endpoint may be used to stream data to Splunk for ingestion.

It is meant for high volume ingestion of machine data.

Configuring the index time

By default, the index time for an event is when the event makes it to the Splunk server.

from("direct:start")
        .to("splunk-hec://localhost:8080?token");

If you are ingesting a large enough dataset with a big enough lag then the time the event hits the server and when that event actually happened could be skewed. If you want to override the index time you can do so.

from("kafka:logs")
        .setHeader(SplunkHECConstants.INDEX_TIME, simple("${headers[kafka.HEADERS].lastKey('TIME')}"))
        .to("splunk-hec://localhost:8080/token");
from("kafka:logs")
        .toD("splunk-hec://localhost:8080/token?time=${headers[kafka.HEADERS].lastKey('TIME')}");

Spring Boot Auto-Configuration

When using splunk-hec with Spring Boot make sure to use the following Maven dependency to have support for auto configuration:

<dependency>
  <groupId>org.apache.camel.springboot</groupId>
  <artifactId>camel-splunk-hec-starter</artifactId>
  <version>x.x.x</version>
  <!-- use the same version as your Camel core version -->
</dependency>

The component supports 5 options, which are listed below.

Name Description Default Type

camel.component.splunk.autowired-enabled

Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.

true

Boolean

camel.component.splunk.bridge-error-handler

Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions occurred while the consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored.

false

Boolean

camel.component.splunk.enabled

Whether to enable auto configuration of the splunk component. This is enabled by default.

Boolean

camel.component.splunk.lazy-start-producer

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

Boolean

camel.component.splunk.splunk-configuration-factory

To use the SplunkConfigurationFactory. The option is a org.apache.camel.component.splunk.SplunkConfigurationFactory type.

SplunkConfigurationFactory
Back to top