Splunk for Jenkins - NO DATA SENT TO SPLUNK

[premraj_vs]

Hi All,

I am trying to integrate Splunk with Jenkins and as per this link https://github.com/jenkinsci/splunk-devops-plugin

I create the latest build and uploaded it in Jenkins.

In /configure page, i provided my splunk server details and test connection verified.

But in https://wiki.jenkins.io/display/JENKINS/Splunk+Plugin+for+Jenkins , UI looks different and i am not seeing any data in Splunk from Jenkins.

Can anyone tell me what is missing.

[aakif]

"jenkins_artifact"
"jenkins_console"
"jenkins_statistics"
"jenkins"

I am getting proper search results for all jenkins indexes but nothing is showing in Jenkins App , Can you please help ?

[dvargas_splunk]

Premraj_vs were you able to get resolution to this issue?

I recently worked with a customer that experienced the same matter. It was determined that on the Jenkins Configuration under event source the variable "source =" was left empty and this seemed to have been the culprit to no data being presented into Splunk App for Jenkins.

Adding the wild card "*" seems to have worked in this situation. I hope that helps.

[yomesky2000]

I spent 3 days trying to fix this issue as Jenkins was not publishing its build analysis to Splunk. This solution worked for me and thanks to @dvargas_splunk. On Jenkins -> Manage Jenkins -> Scroll down to the Splunk connection entries -> Advanced -> Event Source: source="*"
I restarted Jenkins and Splunk service and I started seeing the Jenkins Build Analysis in Splunk

[txiao_splunk]

The plugin version is pretty old, could you please upgrade to latest version on the Jenkins update center?

[premraj_vs]

I tried with the latest version of jenkins jar and still no data pushed to Splunk

[txiao_splunk]

can you see any data in the Search app, pls search
index=jenkins*

[premraj_vs]

No i do not see any data. Can you share with me the meta data that you are using in Jenkins configuration page ?

[txiao_splunk]

I haven't heard any user complain about the default metadata config.
I am wondering the splunk config, e.g. if you used a heavy forwarder for "Http Input" , you can not search the data on heavy forwarder, you have to go to search head or indexer.
To verify it, pls run

hec_host=<splunk-host>
hec_port=8088
hec_token=<splunk-token>
curl -k "https://${hec_host}:${hec_port}/services/collector/event" -H "Authorization: Splunk ${hec_token}" -d \
'{"host":"test-host","index":"jenkins_console","sourcetype":"json:jenkins","source":"logger://dummy","event":{"level":"INFO","log_source":"cmdline","message":"Test HEC"}}'

[premraj_vs]

Can anyone share any insights on this ?