topic Re: Unable to index to Splunk server from MuleSoft in Getting Data In

Unable to index to Splunk server from MuleSoft

Venkat_16 — Wed, 20 Apr 2016 06:36:25 GMT

Greetings everyone!!!

We were trying to integrate Splunk with Mulesoft. we already had splunk plugins in Mulesoft. We gave heavy forwarder IP and 8089 as port number. But we are not getting data in main index.

Is this configuration correct or we need to give indexer IP and port 8089 in the mulesoft configuration...

Please guide us

Re: Unable to index to Splunk server from MuleSoft

jplumsdaine22 — Wed, 20 Apr 2016 15:04:03 GMT

Hi Venkat,

Port 8089 is the Splunk management port - it won't receive data there. I'm not familiar with mulesoft is it generating syslog events or writing its logs to a file?

Is this your first time using Splunk? I strongly recommend doing the Splunk tutorial, - it will take a few hours but it will greatly improve your splunk experience.

http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial

Re: Unable to index to Splunk server from MuleSoft

Venkat_16 — Fri, 22 Apr 2016 10:43:22 GMT

Thanks for the answer

please refer the below documentation link where it suggests the default port to be configured as 8089

http://blogs.mulesoft.com/biz/mule/anypoint-runtime-manager-v1-2-monitoring-servers-and-apps-with-splunk-elk/

i believe we can get data through 8089 port if we are using API calls

Re: Unable to index to Splunk server from MuleSoft

jplumsdaine22 — Fri, 22 Apr 2016 11:15:51 GMT

Ah I understand now. It should be ok to use the heavy forwarder.
Did you configure the input as per the documentation here? https://docs.mulesoft.com/runtime-manager/sending-data-from-arm-to-external-monitoring-software#integrating-to-splunk

You need to create the sourcetype in Splunk before you send events.

Re: Unable to index to Splunk server from MuleSoft

Venkat_16 — Mon, 25 Apr 2016 12:58:39 GMT

Hey Thanks i didnt check this part, Thanks again!!!

Re: Unable to index to Splunk server from MuleSoft

Venkat_16 — Tue, 29 Sep 2020 09:33:08 GMT

Have configured the props.conf as directed in the mulesoft link:

[mule]
TRUNCATE = 0
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = JSON
KV_MODE = JSON
category = Mule Splunk Integration
description = Mule Agent event information

but still we are not able to view any of the logs in splunk.... any way to check to error logs...not error logs in _internal index

Re: Unable to index to Splunk server from MuleSoft

jplumsdaine22 — Wed, 27 Apr 2016 12:27:36 GMT

did you create the input as per the section "Configuring your Runtime Manager Account*" ?

Re: Unable to index to Splunk server from MuleSoft

Venkat_16 — Thu, 28 Apr 2016 05:56:11 GMT

Yes we choose the REST API method to configure the mulesoft
gave heavy forwarder IP and port number 8080 and created a user in heavy forwarder and as well in the Splunk search head and kept default values for the advance settings, Between thanks alot

Re: Unable to index to Splunk server from MuleSoft

santosh12 — Wed, 26 Jul 2017 11:38:49 GMT

Hi Venkat,

Were you successful in sending data from Mulesoft via Heavy forwarder?

regards
Santosh

Re: Unable to index to Splunk server from MuleSoft

Robertaacen — Sat, 03 Mar 2018 04:40:02 GMT

Hi Buddie,

I have also one doubt while using Mulesoft Studio for one of my usecase.

My scenario is to pass the database result as parameter dynamically to the soap web service. I am passing the Parameter via SetPayload component.

I am passing the parameter in this below format, I am getting argument mismatch error.
I tested this argument using logger payload[0][‘RATE’],payload[0][‘APPLICANT_NAME’], it retrieve the value perfectly. When I used this in set-payload I am getting argument mismatch error.

I am looking to resolve this problem.

Could you please advice any pointers, how did you managed to resolve your error?

Thanks in advance.
Robert.
,