Splunk Search

Search result Not consistent

balesh
New Member

Hello Folks,

I am new to splunk SDK and i am trying to write a code that search and return a search result from the splunk log instantly.
I am using splunk sdk for java to connect and fecth the details from logs.
below is what i am trying to achieve:
- Run a transaction in my application (which is configured with splunk)
- search for a keyword in the log after the transaction is completed.

below the code that i used to connect to splunk:

private static Service connectToSplunk() {
    try {
      if(splunkService== null) {
        loadSplunkPropertiesValues();
        HttpService.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2);
        ServiceArgs loginArgs = new ServiceArgs();
        loginArgs.setUsername(properties.getProperty("splunkLoginUserId"));
        loginArgs.setPassword(properties.getProperty("splunkLoginPassword"));
        loginArgs.setHost(properties.getProperty("splunkHost"));
        loginArgs.setPort(Integer.valueOf(properties.getProperty("splunkPort")));
        splunkService = Service.connect(loginArgs);
      }
      return splunkService;
    }
    catch(Exception e) {

    }
  }

  below function to get the details from the splunk:

  private static String getLogDetailsFromSplunk( Service service , String keyword)  {

    JobArgs jobArgs = new JobArgs();
   jobArgs.setExecutionMode(JobArgs.ExecutionMode.NORMAL);
    jobArgs.setEarliestTime(properties.getProperty("jobArgsEarliestTime"));
    jobArgs.setLatestTime(properties.getProperty("jobArgsLatestTime"));
    jobArgs.setStatusBuckets(300);
    String sql ="search sourcetype=emsa_main source="*/logs/cuor-instrument-lifecycle-manager-*" | search msg="BDD Test for database retry queue:database:*" | head 10";
    Job job = service.getJobs().create(sql, jobArgs);

    StringBuffer strLog = new StringBuffer("");
    String strLogAll = null;
    // checking if the job is completed
    while (!job.isDone()) {
      try {
        Thread.sleep(500);
      } catch (Exception e) {

      }
    }
    try{
      Args outputArgs = new Args();
      outputArgs.put("output_mode","json");
      InputStream stream = job.getResults(outputArgs);
      byte[] buffer = new byte[100000];
      while(stream.read(buffer)!=-1)
        strLogAll =new String(buffer);
      //System.out.println(strLogAll);
        //strLog.append(new String(buffer));
    }
    catch(Exception  ne) {
    }

    return strLogAll;
  }

Using the above code, i am able to get the details from the log/splunk. The concern that i am facing is that sometimes, the keyword that i am looking for is found in the result returned, sometimes not.
I am trying to figure out what is the possible causes. i had set the earliest_time to 45 seconds(which is a requirement). Could anyone give me some clue on what could be the possible reasons. A feedback or suggestion would be really appreciated.

Thanks

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...