topic Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk? in Getting Data In

Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

San55240 — Thu, 25 Aug 2016 21:41:48 GMT

I followed http://dev.splunk.com/view/event-collector/SP-CAAAE62 for HTTP Event Collector and am able to run successfully through Eclipse which I can see the input what I passed and it got resulted in the console, but I was not able to see the same input in Splunk. I used same log4j2 as mentioned and gave the Splunk host and token.

My log4j looks like,

    <Http name="http" 
        url="https://http-inputs-******-ma.splunkcloud.com/services/collector/event"
        token="*******-***-****-****-**********"
        disableCertificateValidation="true" batch_size_count="1">
        <PatternLayout pattern="%m" />
    </Http>
</Appenders>

Note : I did test the same with curl. It works and I can see the message.

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

Jeremiah — Fri, 26 Aug 2016 00:04:02 GMT

So you are testing from Eclipse and you're not seeing anything getting posted? Can you verify that your code tried to connect to your event collector endpoint?

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

San55240 — Fri, 26 Aug 2016 01:46:58 GMT

@Jeremiah I can able to see the output in my Eclipse console but not in Splunk. Your ask about "try to connect to your event collector", I just done the same way what the url mentioned seems the connection between my code and HEC is not happening through log4j2. Do you know any other way to test and see the connection is happening in java.

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

gblock_splunk — Sat, 27 Aug 2016 01:12:50 GMT

@San55240, try removing "/services/collector/event" for the url, the logging library sets this. I noticed you did not set the port, is your HEC instance on port 80?

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

San55240 — Sat, 27 Aug 2016 19:16:22 GMT

@gblock I tried removing "/services/collector/event", Still not able to see the logs in Splunk. Yes ,My HEC instance port is running on 80.

It worked when I tried same host and token by curl. Did anyone tried this eclipse example

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

gblock_splunk — Sat, 27 Aug 2016 21:45:29 GMT

Can you show me a gist of the code in your lambda?

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

gblock_splunk — Sat, 27 Aug 2016 21:46:16 GMT

Also did you check the lambda logs to see if there was an error?

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

San55240 — Tue, 06 Sep 2016 17:44:52 GMT

https://github.com/santhoshjoy/hellolambda.git

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

gblock_splunk — Sat, 10 Sep 2016 05:53:05 GMT

I created the original Eclipse example, so I know it can work as I had a working version which I passed off to our docs team. This is against a managed Splunk cloud instance yes?

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

gblock_splunk — Sat, 10 Sep 2016 05:58:56 GMT

Here's a screenshot from when I had this working. You can see the code and the Splunk event on the other side.

https://www.dropbox.com/s/948pvvqkqser7s0/Lambda.png?dl=0

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

gblock_splunk — Sat, 10 Sep 2016 06:01:02 GMT

For sure it should not have /services/collector in the url.

Re: Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

gblock_splunk — Sat, 10 Sep 2016 06:03:31 GMT

Also, can you try specifying port 80 explicitly?