Getting Data In

Can someone provide a work example for Splunk HEC using Java Spring Boot?

aa70627
Communicator

Can someone assist with providing a working example on how to use and send data to Splunk HTTP Event Collect (HEC) from a java Spring Boot application? Please provide settings and code used for pom.xml, log4j.xml and code example. We reviewed the example from http://dev.splunk.com/view/splunk-logging-java/SP-CAAAE7M and we're not sure if its applicable to Java spring boot since spring boot automatically loads up its own logger.

our POM file

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">;

    <modelVersion>4.0.0</modelVersion>
    <groupId>com.myco</groupId>
    <artifactId>javaapp-network</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>javaapp-network</name>
    <description></description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.1.RELEASE</version>
        <relativePath/> 
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
        <spring-cloud.version>Finchley.RC1</spring-cloud.version>
    </properties>

    <repositories>

            <repository>
            <id>spring-milestones</id>
            <name>Spring Milestones</name>
            <url>https://repo.spring.io/milestone</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>

            <repository>
            <id>spring-plugins</id>
            <name>Spring Plugins</name>
            <url>http://repo.spring.io/plugins-release/</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>

     </repositories>

    <dependencies>

        <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
        <version>2.3</version>
    </dependency>

        <dependency>
            <groupId>com.splunk.logging</groupId>
            <artifactId>splunk-library-javalogging</artifactId>
            <version>1.5.3</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-mongodb</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-rest</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-jersey</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.kafka</groupId>
            <artifactId>spring-kafka</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

our log4j2.xml

<Appenders>

    <Socket name="socket" host="server01.myco.com" port="8088">
        <PatternLayout pattern="%p: %m%n" charset="UTF-8"/>
    </Socket>

    <Http name="http-input"
          url="https://server01.myco.com:8088"
          token="C6D6D450-E8CD-4507-8C01-C070A7888924"
          host="server01.myco.com"
          index="javaapp"
          source="splunktest"
          sourcetype="log4j"
          middleware="HttpEventCollectorUnitTestMiddleware"
          batch_size_bytes="0"
          batch_size_count="0"
          batch_interval="0"
          disableCertificateValidation="true">
        <PatternLayout pattern="%m"/>
    </Http>

</Appenders>

<Loggers>
    <Root level="INFO">
    </Root>
    <Logger name="splunk.logger" level="info">
        <AppenderRef ref="socket"/>
    </Logger>

    <Logger name="splunk.log4j" level="info">
        <AppenderRef ref="http-input"/>
    </Logger>

</Loggers>
Labels (1)
1 Solution

sindhuja
Loves-to-Learn Lots

Hi ,

I have same example code which looks same but am facing issue 

am unable to see logs in splunk .

do u have any idea

0 Karma

aa70627
Communicator

Thanks !!! Greatly appreciated.

0 Karma

nytins
Engager

@aa70627 Did u manage to find a solution?

0 Karma

aa70627
Communicator

@nytins yes. The one that is highlighted as answer helped me resolve the issue.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...