topic Re: Why does index creation via Java SDK returns null value? in Splunk Search

Why does index creation via Java SDK returns null value?

Silviya_brayano — Thu, 22 Mar 2018 14:44:36 GMT

Hi colleagues,
I am trying to create index using the Java SDK for Splunk and to reset the "FrozenTimePeriodInSecs" property afterwards.
The code snippet follows:

ServiceArgs loginArgs = new ServiceArgs();
        loginArgs.setUsername("admin");
        loginArgs.setPassword("admin");
        loginArgs.setHost("host");
        loginArgs.setPort(8089);

String indexName = "testIndex_" + System.currentTimeMillis(); 

HttpService.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2);        
Service splunkService = Service.connect(login);
IndexCollection indexCollection = splunkService.getIndexes();
Index createdIndex = indexCollection.create(indexName);
createdIndex.setFrozenTimePeriodInSecs(retentionPeriod);
createdIndex.update();

I run into java.lang.NullPointerException because apparently the the IndexCollection.create(String indexName); returns a null value.
Any idea what am I doing wrong?

Re: Why does index creation via Java SDK returns null value?

Silviya_brayano — Thu, 22 Mar 2018 15:39:06 GMT

On line 10 I actually pass the loginArgs and not login.

Re: Why does index creation via Java SDK returns null value?

Silviya_brayano — Thu, 22 Mar 2018 16:52:15 GMT

Hi all,

I have found the root cause.
The problem is with the capital "I" in the testIndex_<timestamp>.
It turns out that despite my attempt to create an index with name testIndex_<timestamp> (capital "I") on the backend an index with name testindex_<timestamp> (lower case "i") is created.

The method IndexCollection.create(String indexName) sends internal GET request attempting to obtain the Index object, having the original name testIndex_<timestamp> with (capital "I") and since on the back end there is no such thing that method returns null value.

In my opinion that is a bug.

Re: Why does index creation via Java SDK returns null value?

richgalloway — Thu, 22 Mar 2018 17:36:02 GMT

Index names are always lower case. Per the Managing Indexers and Clusters of Indexers docs: "User-defined index names must consist of only numbers, lowercase letters, underscores, and hyphens."

Splunk probably should block attempts to create an index with an invalid name or warn that it changed the name, but I see no bug here.

Re: Why does index creation via Java SDK returns null value?

tgandham1 — Mon, 28 Mar 2022 17:50:39 GMT

EntityCollection<Index> indexes = splunkService.getIndexes();

splunkService.getIndexes();

the above line giving error ,pasted in below.

due this Create index returning null pointer error.