topic Re: com.splunk.Index.submit() with a JSON is not recognized in Splunk as Type Event parameters in Getting Data In

com.splunk.Index.submit() with a JSON is not recognized in Splunk as Type Event parameters

krienstra — Mon, 12 Jul 2021 09:28:28 GMT

I have successfully implemented the Splunk Java SDK to write my own .class and implement the code within programs we run on several machines to send and retrieve data. I am able to retrieve search results as a List of <Event> or submit data to the index.

However, Splunk does not format my submitted data to the main index when presented as JSON.

If I run the following code, the JSON is somehow formatted in the Splunk interface as a JSON with it's red/green formatting HOWEVER the data is not formatted through Type Event and therefore I can not search data based on an "application=test" String:

Index myIndex = service.getIndexes().get("main"); eventArgs.put("sourcetype", "_json"); String input = "{\"account\": \"test\",\"password\": \"Welkom\",\"hostname\": \"DESKTOP-KENNETH\",\"application\": \"test\"}"; myIndex.submit(eventArgs, input);

How do I need to submit a JSON where Splunk will recognize this as a Type Event with it's corresponding key/value pairs?

This search will not retrieve the submitted JSON:

index=main application="test"

Type Event now has only one key/value pair: "timestamp: none".

Re: com.splunk.Index.submit() with a JSON is not recognized in Splunk as Type Event parameters

kamlesh_vaghela — Mon, 12 Jul 2021 10:12:10 GMT

@krienstra

I think your code should work.

I have tried this and worked fine. Can you please try this?

import com.splunk.*; public class App { public static void main(String[] args) throws Exception { HttpService.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2); // Create a map of arguments and add login parameters ServiceArgs loginArgs = new ServiceArgs(); loginArgs.setUsername("admin"); loginArgs.setPassword("admin123"); loginArgs.setHost("localhost"); loginArgs.setPort(8089); // Create a Service instance and log in with the argument map Service service = Service.connect(loginArgs); // Retrieve the index for the data Index myIndex = service.getIndexes().get("main"); Args eventArgs = new Args(); eventArgs.put("sourcetype", "_json"); String input = "{\"account\": \"test\",\"password\": \"Welkom\",\"hostname\": \"DESKTOP-KENNETH\",\"application\": \"test\"}"; myIndex.submit(eventArgs, input); } }

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: com.splunk.Index.submit() with a JSON is not recognized in Splunk as Type Event parameters

krienstra — Mon, 12 Jul 2021 10:30:36 GMT

Hi Kamlesh,

Could you search for "application=test" instead of "sourcetype=_json"? I see there is a problem with adding a "sourcetype: _json" via Args().

This is when I submit(Args eventArgs, String data) - it does not set the Type Event key/value pairs:

This is if I only submit(String data) - it picks up all the key/value pairs:

Re: com.splunk.Index.submit() with a JSON is not recognized in Splunk as Type Event parameters

kamlesh_vaghela — Mon, 12 Jul 2021 11:54:00 GMT

@krienstra

Here, I suggest not to use _json sourcetype and clone it and use.

Or create below configurations in props.conf and send data to this sourcetype.

[m_json] KV_MODE = json

I hope this will help you.

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: com.splunk.Index.submit() with a JSON is not recognized in Splunk as Type Event parameters

krienstra — Mon, 12 Jul 2021 12:40:36 GMT

That's right, I'll skip the "_json" and use another sourcetype. It seems that "_json" is not giving me the right result, I can use any other sourcetype except this (not sure what exactly "_json" does as a sourcetype, but it's not working and I'll refrain from).

"json" does seem to work, giving me the right Event Types key/value pairs:

String input = "{\"account\": \"test\",\"password\": \"Welkom\",\"hostname\": \"DESKTOP-KENNETH\",\"application\": \"test\"}"; Args eventArgs = new Args(); eventArgs.put("sourcetype", "json"); handler.sendEvent(eventArgs, "main", input);