Splunk 6 SDK not connection

[geonspapa]

Hello.

I test Splunk 6 enterprise ver.
and Java SDK Example.
http://dev.splunk.com/view/splunk-plugin-eclipse/SP-CAAAEQX

Sample Code

import java.io.IOException;
import java.io.InputStream;

import com.splunk.Args;
import com.splunk.Event;
import com.splunk.ResultsReaderXml;
import com.splunk.Service;
import com.splunk.ServiceArgs;


public class T2 {

    public static void main(String[] args) {
        // TODO Auto-generated method stub
        // Create login parameters. We suggest finding
        // a better way to store these than hard coding
        // them in your program for production code.
        ServiceArgs serviceArgs = new ServiceArgs();
        serviceArgs.setUsername("admin");
        serviceArgs.setPassword("changeme");
        serviceArgs.setHost("localhost");
        serviceArgs.setPort(8089);

        // Create a Service instance and log in with the argument map
        Service service = Service.connect(serviceArgs);
        // Set the parameters for the search
        Args oneshotSearchArgs = new Args();
        // For a full list of options, see:
        //
        //     http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#POST_search.2Fjobs

        // oneshotSearchArgs.put("earliest_time", "now-1w");
        // oneshotSearchArgs.put("latest_time",   "now");

        InputStream resultsStream = service.oneshotSearch("search index=_internal | head 5",
                oneshotSearchArgs);

        try {
            ResultsReaderXml resultsReader = new ResultsReaderXml(resultsStream);

            for (Event event : resultsReader) {
                // Process each event
                for (String key : event.keySet()) {
                    System.out.println(key + ": " + event.get(key));
                }
            }
            resultsReader.close();
        } catch (IOException e) {
            // TODO Autogenerated code stub
            e.printStackTrace();
        }
    }
}

SPL 5 is connect ok.

_subsecond: .663
_sourcetype: splunkd_access
index: _internal
host: splunk
_cd: 12:96421
_serial: 0
_si: splunk,_internal
splunk_server: splunk
linecount: 1
_indextime: 1381989165
source: /opt/splunk5/var/log/splunk/splunkd_access.log
_raw: 127.0.0.1 - admin [17/Oct/2013:14:52:43.663 +0900] "GET /services/search/jobs/rt_1381988241.13 HTTP/1.1" 200 11646 - - - 5ms
sourcetype: splunkd_access
_bkt: _internal~12~E9C940D5-EA90-4208-834D-B6EEBC90AF82
_time: 2013-10-17T14:52:43.663+09:00

but SPL 6 is HTTP 400 error.

Exception in thread "main" com.splunk.HttpException: HTTP 400
    at com.splunk.HttpException.create(HttpException.java:59)
    at com.splunk.HttpService.send(HttpService.java:355)
    at com.splunk.Service.send(Service.java:1203)
    at com.splunk.HttpService.post(HttpService.java:212)
    at com.splunk.Service.login(Service.java:1040)
    at com.splunk.Service.login(Service.java:1020)
    at com.splunk.Service.connect(Service.java:161)
    at T2.main(T2.java:25)

same example not run.

help me!!

[mgroves_splunk]

Thanks for the details and sorry about the problems.

We are actively working on updated all of our SDKs to work with Splunk 6.

[alexanderjjones]

First of all, Splunk is a great product. However, myself and a friend both found some major issues in the Splunk 6 SDK...

My friend works with the Splunk PHP SDK, and I work with Splunk Python SDK. We work on completely separate projects in different cities. Everything worked fine for us with Splunk 5... yet the Splunk 6 SDK has similar issues for both of us... so I know this is not an isolated incident.

We both upgraded to Splunk 6 and the latest SDKs, but Splunk 6 broke both our back-end code (https API on 8089). We could connect to the server, but had various issues getting data out. Within 24h we both downgraded back to Splunk 5 , which solved the problems.

To Splunk: Pleaes fix your SDKs! They are broken! Heck, even just run the latest version (1.1) Python SDK unit tests against Splunk 6. The unit tests don't work. We see these issues in the PHP SDK and Python SDK, so I assume they must exist in other SDKs.

hint: for Python, look at ./examples/search.py. That won't run. However, ./examples/oneshot.py runs fine.

You've got a great product... please fix your SDK.

[Damien_Dallimor]

Change your password from the default "changeme" , and then try again with your new password.

Also , what version of the Java SDK are you using ? 1.2 ?

[mlohbihler]

I've confirmed that geonspapa's solution works. Build the jar file from the sources in the SDK, and it will work with verson 6. Would be great if someone at Splunk could update the downloadable jar file.

[geonspapa]

I had resolved problem.
Trouble is splunk-1.2.jar.
I use build in sdk/dist/splunk-1.2.jar.

http://dev.splunk.com/goto/sdk-java-jar download file is not run.

[Damien_Dallimor]

Weird. I just copy/pasted your exact code into Eclipse and it worked fine.

Splunk 6 , Ubuntu 12.04 , Java SDK 1.2

[geonspapa]

Yes I have chane default password. and SDK is 1.2 ver.

OS is centos 6.4