topic Re: Does Splunk free license allow usage Splunk java SDK? in Splunk Dev

Does Splunk free license allow usage Splunk java SDK?

nimakaveh — Fri, 17 May 2013 01:55:36 GMT

Based on my research free license doesn't have authentication process. I want to get connected to Splunk through java SDK but I am getting the following error. And this is my code:

Note: I am running Splunk on a server not localhost.

public static void main(String[] args) {
// TODO Auto-generated method stub
Map connectionArgs = new HashMap();
connectionArgs.put("host", "MY SERVER");
connectionArgs.put("username", "");
connectionArgs.put("password", "*");
connectionArgs.put("port", 8000);
connectionArgs.put("scheme", "https");
try
{
// will login and save the session key which gets put in the HTTP Authorization header
Service splunkService = Service.connect(connectionArgs);
}

This is the error:
[Fatal Error] :1:1: Content is not allowed in prolog.
com.splunk.HttpException: HTTP 400
at com.splunk.HttpException.create(HttpException.java:59)
at com.splunk.HttpService.send(HttpService.java:355)
at com.splunk.Service.send(Service.java:1211)
at com.splunk.HttpService.post(HttpService.java:212)
at com.splunk.Service.login(Service.java:1044)
at com.splunk.Service.login(Service.java:1024)
at com.splunk.Service.connect(Service.java:161)
at com.splunk.demo.SplunkSSH.main(SplunkSSH.java:26)

Also I added a setting to $SPLUNK_HOME/etc/system/local/server.conf and restarting; however, it didn't help!

[general]
allowRemoteLogin = always

Re: Does Splunk free license allow usage Splunk java SDK?

miteshvohra — Fri, 17 May 2013 02:35:31 GMT

Free license has Authentication process limited to first 60-days of its use. After that, the authentication process, background jobs, alerts, etc get disabled. However, your reports, dashboards and 500-MB limit continue to work.

Re: Does Splunk free license allow usage Splunk java SDK?

Ayn — Fri, 17 May 2013 08:11:59 GMT

Not that I've used the Java SDK, but if it's anything like the other SDK's I'm pretty sure you don't want to connect to port 8000, which is the port used for the Splunk web interfaces on instances that have it enabled. The SDK's generally communicate with Splunk instances using the REST API, which is available via HTTPS on port 8089.

Re: Does Splunk free license allow usage Splunk java SDK?

sbrant_splunk — Fri, 17 May 2013 22:11:04 GMT

Another option would be to request a developer license on the dev website:

http://dev.splunk.com/

Re: Does Splunk free license allow usage Splunk java SDK?

nimakaveh — Mon, 20 May 2013 23:04:56 GMT

I got developer license as well but still I can't connect to Splunk server. The authentication fails!! I couldn't find anything on the web except connecting to "localhost" which is not my case in here.

Re: Does Splunk free license allow usage Splunk java SDK?

Neeraj_Luthra — Tue, 21 May 2013 03:10:18 GMT

First - Confirm from Splunk UI that the license is correctly added.
Second - Are you logging in with default credentials - admin/changeme? By default, Splunk doesn't allow remote login with default password.

Re: Does Splunk free license allow usage Splunk java SDK?

nimakaveh — Tue, 21 May 2013 21:26:50 GMT

I checked and the license is correctly added. No I am not using default credentials, I am using my own username/pass which I use to login to Splunk.
This is my code:

public static void main(String[] args) {
    // TODO Auto-generated method stub
    Map<String, Object> connectionArgs = new HashMap<String, Object>();
    connectionArgs.put("host", "MY SERVER");
    connectionArgs.put("username", "****");
    connectionArgs.put("password", "****");
    connectionArgs.put("port", 8000);
    connectionArgs.put("scheme", "https");
}

Any idea?

Re: Does Splunk free license allow usage Splunk java SDK?

Ayn — Tue, 21 May 2013 21:27:47 GMT

And you're sure you're really supposed to be using port 8000?

Re: Does Splunk free license allow usage Splunk java SDK?

Neeraj_Luthra — Tue, 21 May 2013 21:36:26 GMT

Ayn is right. You should be connecting to port 8089, the default management port. 8000 is the web port that UI uses.

Re: Does Splunk free license allow usage Splunk java SDK?

nimakaveh — Tue, 21 May 2013 21:56:36 GMT

I tried both ports none of them worked!

Re: Does Splunk free license allow usage Splunk java SDK?

sbrant_splunk — Tue, 21 May 2013 22:07:50 GMT

Have you confirmed that there is no firewall in place on the Splunk host? Check which interface is listening on port 8089 (run netstat -an on the Splunk host)? Is it 0.0.0.0:8089? You can also try to telnet to port 8089 from the host that you're trying to run your Java app from, to see if you can connect that way.

Re: Does Splunk free license allow usage Splunk java SDK?

nimakaveh — Tue, 21 May 2013 22:29:10 GMT

the result of nestat -an

tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN

tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN

tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN

But when I telnet to port 8089 from my machine it doesn't work
nimakaveh$ telnet MYSERVER 8089
Trying 172.23.4.205...
telnet: connect to address 172.23.4.205: Connection refused
telnet: Unable to connect to remote host

Re: Does Splunk free license allow usage Splunk java SDK?

sbrant_splunk — Tue, 21 May 2013 22:33:18 GMT

Sounds like you have a firewall blocking port 8089, either on the host or on your network, in front of the host.

Re: Does Splunk free license allow usage Splunk java SDK?

nimakaveh — Tue, 21 May 2013 22:40:29 GMT

I will check port 8089 on my host and will post the result here. Thanks for you help so far.

Re: Does Splunk free license allow usage Splunk java SDK?

nimakaveh — Thu, 23 May 2013 00:18:44 GMT

sbrant_splunk thanks for your help, it is working now. I had an issue with iptable and port 8089 was closed.