topic Re: Jenkins Build logs to Splunk in Getting Data In

Jenkins Build logs to Splunk

Maries — Sat, 08 Feb 2025 04:59:10 GMT

Team,

I'm trying to push Jenkins Build Logs to Splunk.

Installed Splunk Plugin (1.10.1) in my Cloudbees Jenkins. Configured HTTP host, port & token - Tested Connection and it looks good.

In Splunk, created a HEC Input in the below file with the content as below

File name : /opt/app/splunk/etc/apps/splunk_httpinput/local/inputs.conf

[http://jenkins_build_logs]

description = Jenkins build Logs

disabled = 0

index = infra

indexes = infra

sourcetype = jenkins:build

token =

useACK = 0

Getting the below error in the Splunk logs -

/opt/app/splunk/var/log/splunk

02-08-2025 04:52:07.704 +0000 ERROR HttpInputDataHandler [17467 HttpDedicatedIoThread-1] - Failed processing http input, token name=jenkins_build_logs, channel=n/a, source_IP=10.212.102.217, reply=7, status_message="Incorrect index", status=400, events_processed=1, http_input_body_size=381, parsing_err="invalid_index='jenkins_console'"

02-08-2025 04:54:14.617 +0000 ERROR HttpInputDataHandler [17467 HttpDedicatedIoThread-1] - Failed processing http input, token name=jenkins_build_logs, channel=n/a, source_IP=10.212.100.150, reply=7, status_message="Incorrect index", status=400, events_processed=1, http_input_body_size=317, parsing_err="invalid_index='jenkins_statistics'"

Re: Jenkins Build logs to Splunk

kiran_panchavat — Sat, 08 Feb 2025 05:05:28 GMT

@MariesDid you create the index on the indexer?

Re: Jenkins Build logs to Splunk

kiran_panchavat — Sat, 08 Feb 2025 05:07:32 GMT

@Maries Check this

https://plugins.jenkins.io/splunk-devops/

https://medium.com/cloud-native-daily/monitoring-made-easy-enhancing-ci-cd-with-splunk-and-jenkins-integration-576eab0bff9

Re: Jenkins Build logs to Splunk

kiran_panchavat — Sat, 08 Feb 2025 05:11:46 GMT

@Maries

NOTE: You can keep the index to the default (main, in general) or ‘jenkins’ or whatever you prefer while setting up the token, as the Splunk app for Jenkins is capable of filtering the events and redirecting them to the correct pre-configured indexes(this app ships with

four indexes – Jenkins, Jenkins_statistics, Jenkins_console, Jenkins_artifact).

Re: Jenkins Build logs to Splunk

Maries — Sat, 08 Feb 2025 06:23:24 GMT

Configured as below.. Now the error is resolved - But not getting the jenkins logs into splunk . only seeing the below response in Splunk

Configuration :

[http://jenkins_build_logs]

description = Jenkins build Logs

disabled = 0

sourcetype = jenkins:build

token =

useACK = 0

Logs in splunk

ping from jenkins plugin raw event ping