Getting Data In

Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

San55240
New Member

I followed http://dev.splunk.com/view/event-collector/SP-CAAAE62 for HTTP Event Collector and am able to run successfully through Eclipse which I can see the input what I passed and it got resulted in the console, but I was not able to see the same input in Splunk. I used same log4j2 as mentioned and gave the Splunk host and token.

My log4j looks like,

    <Http name="http" 
        url="https://http-inputs-******-ma.splunkcloud.com/services/collector/event"
        token="*******-***-****-****-**********"
        disableCertificateValidation="true" batch_size_count="1">
        <PatternLayout pattern="%m" />
    </Http>
</Appenders>

Note : I did test the same with curl. It works and I can see the message.

0 Karma

gblock_splunk
Splunk Employee
Splunk Employee

@San55240, try removing "/services/collector/event" for the url, the logging library sets this. I noticed you did not set the port, is your HEC instance on port 80?

0 Karma

San55240
New Member

@gblock I tried removing "/services/collector/event", Still not able to see the logs in Splunk. Yes ,My HEC instance port is running on 80.

It worked when I tried same host and token by curl. Did anyone tried this eclipse example

0 Karma

gblock_splunk
Splunk Employee
Splunk Employee

Can you show me a gist of the code in your lambda?

0 Karma

gblock_splunk
Splunk Employee
Splunk Employee

Also did you check the lambda logs to see if there was an error?

0 Karma

San55240
New Member
0 Karma

gblock_splunk
Splunk Employee
Splunk Employee

I created the original Eclipse example, so I know it can work as I had a working version which I passed off to our docs team. This is against a managed Splunk cloud instance yes?

0 Karma

gblock_splunk
Splunk Employee
Splunk Employee

Here's a screenshot from when I had this working. You can see the code and the Splunk event on the other side.

https://www.dropbox.com/s/948pvvqkqser7s0/Lambda.png?dl=0

0 Karma

gblock_splunk
Splunk Employee
Splunk Employee

Also, can you try specifying port 80 explicitly?

0 Karma

gblock_splunk
Splunk Employee
Splunk Employee

For sure it should not have /services/collector in the url.

0 Karma

Jeremiah
Motivator

So you are testing from Eclipse and you're not seeing anything getting posted? Can you verify that your code tried to connect to your event collector endpoint?

0 Karma

San55240
New Member

@Jeremiah I can able to see the output in my Eclipse console but not in Splunk. Your ask about "try to connect to your event collector", I just done the same way what the url mentioned seems the connection between my code and HEC is not happening through log4j2. Do you know any other way to test and see the connection is happening in java.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...