Splunk Dev

Java SDK: Most efficient way to wait for a particular event

teresap
Engager

Some backstory:

  • I am writing end-to-end automation for a microservice that writes events to Splunk.
  • I use Java Splunk SDK version 1.6.3.0, which is the latest version stored on our artifactory
  • After I drop files in a particular folder on S3, our service calls various internal APIs and logs the status to Splunk.
  • After dropping the files, my automation needs to wait for a particular unique event to appear and then continues doing some internal validations.

I would like to be able to wait for a specific event to appear on Splunk, with a timeout of some number of seconds in case the event never happens. Currently I do this with a for loop and poll for the specified event to appear. However, I wonder if there might be a more efficient way to do this.

Here's a sample of an event I need to wait for:

{   
<snip/>
     file_url:   https://some.website/somefile.json 
     id:     12345  
     level:  30 
     msg:    File processing succeeded  
     name:   myservicename
<snip/>
}

And a sample query:

index=myindex sourcetype=myservicename msg="File processing succeeded" file_url="https://some.website/somefile.json" id="12345"

In this example, index, sourcetype, and msg are the same every time I run my test case. file_url and id are unique each time.

What is the recommended way to wait for a particular event? What kind of query is recommended (blocking/etc)?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...