Getting Data In

Can someone provide a work example for Splunk HEC using Java Spring Boot?

aa70627
Communicator

Can someone assist with providing a working example on how to use and send data to Splunk HTTP Event Collect (HEC) from a java Spring Boot application? Please provide settings and code used for pom.xml, log4j.xml and code example. We reviewed the example from http://dev.splunk.com/view/splunk-logging-java/SP-CAAAE7M and we're not sure if its applicable to Java spring boot since spring boot automatically loads up its own logger.

our POM file

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">;

    <modelVersion>4.0.0</modelVersion>
    <groupId>com.myco</groupId>
    <artifactId>javaapp-network</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>javaapp-network</name>
    <description></description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.1.RELEASE</version>
        <relativePath/> 
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
        <spring-cloud.version>Finchley.RC1</spring-cloud.version>
    </properties>

    <repositories>

            <repository>
            <id>spring-milestones</id>
            <name>Spring Milestones</name>
            <url>https://repo.spring.io/milestone</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>

            <repository>
            <id>spring-plugins</id>
            <name>Spring Plugins</name>
            <url>http://repo.spring.io/plugins-release/</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>

     </repositories>

    <dependencies>

        <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
        <version>2.3</version>
    </dependency>

        <dependency>
            <groupId>com.splunk.logging</groupId>
            <artifactId>splunk-library-javalogging</artifactId>
            <version>1.5.3</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-mongodb</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-rest</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-jersey</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.kafka</groupId>
            <artifactId>spring-kafka</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

our log4j2.xml

<Appenders>

    <Socket name="socket" host="server01.myco.com" port="8088">
        <PatternLayout pattern="%p: %m%n" charset="UTF-8"/>
    </Socket>

    <Http name="http-input"
          url="https://server01.myco.com:8088"
          token="C6D6D450-E8CD-4507-8C01-C070A7888924"
          host="server01.myco.com"
          index="javaapp"
          source="splunktest"
          sourcetype="log4j"
          middleware="HttpEventCollectorUnitTestMiddleware"
          batch_size_bytes="0"
          batch_size_count="0"
          batch_interval="0"
          disableCertificateValidation="true">
        <PatternLayout pattern="%m"/>
    </Http>

</Appenders>

<Loggers>
    <Root level="INFO">
    </Root>
    <Logger name="splunk.logger" level="info">
        <AppenderRef ref="socket"/>
    </Logger>

    <Logger name="splunk.log4j" level="info">
        <AppenderRef ref="http-input"/>
    </Logger>

</Loggers>
Labels (1)
1 Solution

sindhuja
Loves-to-Learn Lots

Hi ,

I have same example code which looks same but am facing issue 

am unable to see logs in splunk .

do u have any idea

0 Karma

aa70627
Communicator

Thanks !!! Greatly appreciated.

0 Karma

nytins
New Member

@aa70627 Did u manage to find a solution?

0 Karma

aa70627
Communicator

@nytins yes. The one that is highlighted as answer helped me resolve the issue.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...