Splunk Dev

fail to connect with java sdk

perseger
Explorer

Hi,

I'm trying to connect to Splunk API through java sdk, but get stuck when creating a job.

// Create a map of arguments and add login parameters
    ServiceArgs loginArgs = new ServiceArgs();
    loginArgs.setHost("localhost");
    loginArgs.setPort(8089);

    // Connect to Splunk
    Service service = Service.connect(loginArgs);

    JobArgs jobargs = new JobArgs();
    jobargs.setExecutionMode(JobArgs.ExecutionMode.NORMAL);
    JobCollection jobs = service.getJobs();
    Job job = jobs.create("search * | head 5", jobargs); // <<--- this fails

    // Wait for the search to finish
    while (!job.isDone()) {
        try {
            Thread.sleep(500);
        } catch (InterruptedException e) {
            throw new RuntimeException(e);
        }
    }

    // Get the search results 
    try (InputStream resultsNormalSearch = job.getResults()) {
        String inputStreamString = new Scanner(resultsNormalSearch, "UTF-8").useDelimiter("\\A").next();
        System.out.println(inputStreamString);
    } catch (IOException e) {
        e.printStackTrace();  //To change body of catch statement use File | Settings | File Templates.
    }

I'm running Splunk Java SDK 1.2, Splunk Free licence 6.0, Java 7, Windows 7

It works in Splunk 5.0.4 but running against Splunk 6 I get the following error:

[Fatal Error] :1:3: Dokumentets kodtext före rotelementet måste vara välformulerad. --> in english --> Document code text before the root element must be well-formed.

Exception in thread "main" com.splunk.HttpException: HTTP 400
    at com.splunk.HttpException.create(HttpException.java:59)
    at com.splunk.HttpService.send(HttpService.java:355)
    at com.splunk.Service.send(Service.java:1203)
    at com.splunk.HttpService.post(HttpService.java:212)
    at com.splunk.JobCollection.create(JobCollection.java:79)
    at com.splunk.JobCollection.create(JobCollection.java:111)
    at se.lul.fris.splunkpinger.Main2.main(Main2.java:28)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:601)
    at com.intellij.rt.execution.application.AppMain.main(AppMain.java:120)

Does anyone know what's wrong?
Thanks

Tags (2)

npbala_22
Explorer

Still Getting same error.. Can you resolve this

erritesh17
Path Finder

Hi ,
Here I will resolve that issue ,
Follow that step

public class SplunkConnection {

public String secureConnection() throws JSONException, IOException{

 HttpService.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2);

    Map <String,Object> connectionArgs = new HashMap<String,Object>();
    connectionArgs.put("host", "DEVELOPMENT");
    connectionArgs.put("username", "admin");
    connectionArgs.put("password", "*****");
    connectionArgs.put("port", 8089);
    connectionArgs.put("scheme", "https");
    Service splunkService = Service.connect(connectionArgs);
    Args queryArgs = new Args();
    queryArgs.put("earliest_time","0");
    queryArgs.put("latest_time","now");
Job job = splunkService.getJobs().create("search index=*");
while(!job.isDone()){
    try{
        Thread.sleep(500);
    }catch (Exception exp){
        exp.printStackTrace();
    }
}
try{
    Args outputArgs = new Args();
    outputArgs.put("output_mode", "json");
    InputStream inputStream = job.getResults(outputArgs);
    byte[] buffer = new byte[4096];
    String json= "";
    while(inputStream.read(buffer)!= -1){
        json = new String(buffer);
        logger.info(json );     
    }
    return json;

} catch(Exception e){
    e.printStackTrace();
}
    return null;
}

}
Thank you,
If you get any issue please let me know.

bgadsk
New Member

Did you end up fixing this issue? If so, how? I am facing the same issue now.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...