You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by bu...@apache.org on 2017/01/27 20:18:41 UTC
svn commit: r1005781 - in /websites/production/camel/content:
cache/main.pageCache splunk.html
Author: buildbot
Date: Fri Jan 27 20:18:40 2017
New Revision: 1005781
Log:
Production update by buildbot for camel
Modified:
websites/production/camel/content/cache/main.pageCache
websites/production/camel/content/splunk.html
Modified: websites/production/camel/content/cache/main.pageCache
==============================================================================
Binary files - no diff available.
Modified: websites/production/camel/content/splunk.html
==============================================================================
--- websites/production/camel/content/splunk.html (original)
+++ websites/production/camel/content/splunk.html Fri Jan 27 20:18:40 2017
@@ -85,66 +85,77 @@
<tbody>
<tr>
<td valign="top" width="100%">
-<div class="wiki-content maincontent"><h2 id="Splunk-SplunkComponent">Splunk Component</h2><p><strong>Available as of Camel 2.13</strong></p><p>The Splunk component provides access to <a shape="rect" class="external-link" href="http://docs.splunk.com/Documentation/Splunk/latest" rel="nofollow">Splunk</a> using the Splunk provided <a shape="rect" class="external-link" href="https://github.com/splunk/splunk-sdk-java" rel="nofollow">client</a> api, and it enables you to publish and search for events in Splunk.</p><p>Maven users will need to add the following dependency to their pom.xml for this component:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="brush: xml; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ <dependency>
- <groupId>org.apache.camel</groupId>
- <artifactId>camel-splunk</artifactId>
- <version>${camel-version}</version>
- </dependency>
-]]></script>
-</div></div><h3 id="Splunk-URIformat">URI format</h3><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ splunk://[endpoint]?[options]
-]]></script>
-</div></div><h3 id="Splunk-ProducerEndpoints:">Producer Endpoints:</h3><div class="confluenceTableSmall"><div class="table-wrap">
- <table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Endpoint</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>stream</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Streams data to a named index or the default if not specified. <br clear="none"> When using stream mode be aware of that Splunk has some internal buffer (about 1MB or so) before events gets to the index. <br clear="none"> If you need realtime, better use submit or tcp mode.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>submit</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>submit mode. Uses Splunk rest api to publish events to a named index or the default if not specified.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>tcp</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>tcp mode. Streams data to a tcp port, a
nd requires a open receiver port in Splunk.</p></td></tr></tbody></table>
-</div></div><p>When publishing events the message body should contain a SplunkEvent.  See comment under message body.</p><p><strong>Example</strong></p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ from("direct:start").convertBodyTo(SplunkEvent.class)
- .to("splunk://submit?username=user&password=123&index=myindex&sourceType=someSourceType&source=mySource")...
+<div class="wiki-content maincontent"><h2 id="Splunk-SplunkComponent">Splunk Component</h2><p><strong>Available as of Camel 2.13</strong></p><p>The Splunk component provides access to <a shape="rect" class="external-link" href="http://docs.splunk.com/Documentation/Splunk/latest" rel="nofollow">Splunk</a> using the Splunk provided <a shape="rect" class="external-link" href="https://github.com/splunk/splunk-sdk-java" rel="nofollow">client</a> api, and it enables you to publish and search for events in Splunk.</p><p>Maven users will need to add the following dependency to their <strong><code>pom.xml</code></strong> for this component:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="brush: xml; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[<dependency>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>camel-splunk</artifactId>
+ <version>${camel-version}</version>
+</dependency>
+]]></script>
+</div></div><h3 id="Splunk-URIFormat">URI Format</h3><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[splunk://[endpoint]?[options]
+]]></script>
+</div></div><h3 id="Splunk-ProducerEndpoints">Producer Endpoints</h3><div class="confluenceTableSmall"><div class="table-wrap">
+ <table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Endpoint</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>stream</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Streams data to a named index, or the default index if not specified. When using stream mode be aware that Splunk has some internal buffer (about 1MB or so) before events gets to the index. <br clear="none"> If you need realtime, better use <strong><code>submit</code></strong> or <strong><code>tcp</code></strong> mode.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>submit</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Uses Splunk's Rest API to publish events to a named index, or the default if not specified.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>tcp</code></p></td><td co
lspan="1" rowspan="1" class="confluenceTd"><p>Streams data to a TCP port, and requires a open receiver port in Splunk.</p></td></tr></tbody></table>
+</div></div><p>When publishing events the message body should contain a <strong><code>SplunkEvent</code></strong>. See later.</p><p><strong>Example</strong></p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[from("direct:start")
+ .convertBodyTo(SplunkEvent.class)
+ .to("splunk://submit?username=user&password=123&index=myindex&sourceType=someSourceType&source=mySource");
]]></script>
-</div></div><p>In this example a converter is required to convert to a SplunkEvent class.</p><h3 id="Splunk-ConsumerEndpoints:">Consumer Endpoints:</h3><div class="confluenceTableSmall"><div class="table-wrap">
- <table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Endpoint</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>normal</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Performs normal search and requires a search query in the search option.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>savedsearch</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Performs search based on a search query saved in splunk and requires the name of the query in the savedSearch option.</p></td></tr></tbody></table>
+</div></div><p>In this example a converter is required to convert to a <strong><code>SplunkEvent</code></strong> class.</p><h3 id="Splunk-ConsumerEndpoints">Consumer Endpoints</h3><div class="confluenceTableSmall"><div class="table-wrap">
+ <table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Endpoint</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>normal</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Performs normal search and requires a search query in the search option.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>savedsearch</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Performs search based on a search query saved in Splunk and requires the name of the query in the <strong><code>savedSearch</code></strong> option.</p></td></tr></tbody></table>
</div></div><p><strong>Example</strong></p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ from("splunk://normal?delay=5s&username=user&password=123&initEarliestTime=-10s&search=search index=myindex sourcetype=someSourcetype")
- .to("direct:search-result");
+<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[from("splunk://normal?delay=5s&username=user&password=123&initEarliestTime=-10s&search=search index=myindex sourcetype=someSourcetype")
+ .to("direct:search-result");
]]></script>
-</div></div><p>camel-splunk creates a route exchange per search result with a SplunkEvent in the body.</p><h3 id="Splunk-URIOptions">URI Options</h3><div class="confluenceTableSmall"><div class="table-wrap">
- <table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Default Value</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Context</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>host</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>localhost</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk host.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>port</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>8089</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk port</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">scheme</td><td colspan="1" rowspan="1" class="confluenceTd"
>https</td><td colspan="1" rowspan="1" class="confluenceTd">Both</td><td colspan="1" rowspan="1" class="confluenceTd">Scheme to use as either http or https</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>username</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Username for Splunk</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>password</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Password for Splunk</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>connectionTimeout</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>5000</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenc
eTd"><p>Timeout in MS when connecting to Splunk server</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>useSunHttpsHandler</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>false</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Use sun.net.www.protocol.https.Handler Https handler to establish the Splunk Connection. <br clear="none"> Can be useful when running in application servers to avoid app. server https handling.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">sslProtocol</td><td colspan="1" rowspan="1" class="confluenceTd">TLSv1.2</td><td colspan="1" rowspan="1" class="confluenceTd">Both</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Camel 2.16:</strong> The SSL protocol to use. Can be any of TLSv1.2,TLSv1.1,TLSv1,SSLv3. This is only in use if scheme is https</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>index</p></td><td
colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Producer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk index to write to</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>sourceType</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Producer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk sourcetype arguement</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>source</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Producer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk source arguement</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>tcpReceiverPort</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>0</p></td><td colspan="1" rowspan="1" class="conf
luenceTd"><p>Producer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk tcp receiver port when using tcp producer endpoint.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">raw</td><td colspan="1" rowspan="1" class="confluenceTd">false</td><td colspan="1" rowspan="1" class="confluenceTd">Producer</td><td colspan="1" rowspan="1" class="confluenceTd"><p><strong>Camel 2.16.0</strong> : Should the body be inserted raw (true/false). <br clear="none">If true, the body will be transformed to a string before it's send to Splunk.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>initEarliestTime</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Initial start offset of the first search. Required</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>earliestTime</p></td><td colspan="1"
rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Earliest time of the search time window.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>latestTime</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Latest time of the search time window.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>count</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>0</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>A number that indicates the maximum number of entities to return. <br clear="none"> Note this is not the same as maxMessagesPerPoll which currently is unsupported</p></td></tr><tr><td colspan="1" rowspan="1
" class="confluenceTd"><p>search</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The Splunk query to run</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>savedSearch</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The name of the query saved in Splunk to run</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>streaming</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>false</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><strong>Camel 2.14.0</strong> : Stream exchanges as they are received from Splunk, rather than returning all of them in one batch. This has the benefit
of receiving results faster, as well as requiring less memory as exchanges aren't buffered in the component.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">eventHost</td><td colspan="1" rowspan="1" class="confluenceTd">null</td><td colspan="1" rowspan="1" class="confluenceTd">Producer</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Camel 2.17:</strong>  Override the default Splunk event host field</td></tr></tbody></table>
-</div></div><h3 id="Splunk-Messagebody">Message body</h3><p>Splunk operates on data in key/value pairs. The SplunkEvent class is a placeholder for such data, and should be in the message body <br clear="none"> for the producer. Likewise it will be returned in the body per search result for the consumer.</p><p>As of Camel 2.16.0 you can send raw data to Splunk by setting the raw option on the producer endpoint. This is useful for eg. json/xml and other payloads where Splunk has build in support. </p><h3 id="Splunk-UseCases">Use Cases</h3><p>Search Twitter for tweets with music and publish events to Splunk</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ from("twitter://search?type=polling&keywords=music&delay=10&consumerKey=abc&consumerSecret=def&accessToken=hij&accessTokenSecret=xxx")
- .convertBodyTo(SplunkEvent.class)
- .to("splunk://submit?username=foo&password=bar&index=camel-tweets&sourceType=twitter&source=music-tweets");
+</div></div><p><strong><code>camel-splunk</code></strong> creates a route exchange per search result with an instance of <strong><code>org.apache.camel.component.splunk.event.SplunkEvent</code></strong> in the body.</p><h3 id="Splunk-URIOptions">URI Options</h3><div class="confluenceTableSmall"><div class="table-wrap">
+ <table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Default Value</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Context</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>host</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>localhost</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk host.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>port</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>8089</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk port.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><co
de>scheme</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>https</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Scheme to use. Can be one of: <strong><code>HTTP</code></strong> or <strong><code>HTTPS</code></strong>.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>username</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk username.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>password</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk password.</p></td></tr><tr><td colspan="1" rowspan="1"
class="confluenceTd"><p><code>connectionTimeout</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>5000</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk server connection timeout, in milliseconds.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>useSunHttpsHandler</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>false</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>When <strong><code>true</code></strong> an instance of <strong><code>sun.net.www.protocol.https.Handler</code></strong> is used to establish the connection to Splunk.</p><p>Can be useful when running in application servers to avoid application server HTTPS handling.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>sslProtocol</code></p></td><td cols
pan="1" rowspan="1" class="confluenceTd"><p><code>TLSv1.2</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Both</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><strong>Camel 2.16:</strong> The SSL protocol to use. Can be one of: <strong><code>TLSv1.2</code></strong>, <strong><code>TLSv1.1</code></strong>, <strong><code>TLSv1</code></strong>, <strong><code>SSLv3</code></strong>.</p><p><strong>Note</strong>: this option is ignored unless the scheme is HTTPS.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>index</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Producer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk index to write to.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>sourceType</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><
td colspan="1" rowspan="1" class="confluenceTd"><p>Producer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk sourcetype argument.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>source</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Producer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk source argument.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>tcpReceiverPort</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>0</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Producer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Splunk TCP receiver port when using TCP producer endpoint.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>raw</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>false</code></p></td><td colspan="1" rowsp
an="1" class="confluenceTd"><p>Producer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><strong>Camel 2.16.0</strong> : Governs whether the body should be inserted as raw.</p><p>If <strong><code>true</code></strong>, the body will be transformed to a <strong><code>java.lang.String</code></strong> before it's send to Splunk.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>initEarliestTime</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Initial start offset of the first search. Required.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>earliestTime</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceT
d"><p>Earliest time of the search time window.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>latestTime</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Latest time of the search time window.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>count</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>0</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>A number that indicates the maximum number of entities to return.</p><p> </p>
+ <div class="confluence-information-macro confluence-information-macro-warning">
+ <span class="aui-icon aui-icon-small aui-iconfont-error confluence-information-macro-icon"></span>
+ <div class="confluence-information-macro-body">
+ This is not the same as 
+ <strong><code>maxMessagesPerPoll</code></strong> option, which currently is unsupported.
+ </div>
+ </div></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>search</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The Splunk query to run.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>savedSearch</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The name of the query saved in Splunk to run.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>streaming</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>false</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Consumer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><strong>Camel 2.14.0<
/strong> : Stream exchanges as they are received from Splunk, rather than returning all of them in one batch. This has the benefit of receiving results faster, as well as requiring less memory as exchanges aren't buffered in the component.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>eventHost</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Producer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><strong>Camel 2.17:</strong>  Override the default Splunk event host field.</p></td></tr></tbody></table>
+</div></div><h3 id="Splunk-MessageBody">Message Body</h3><p>Splunk operates on data in key/value pairs. The <strong><code>SplunkEvent</code></strong> class is a placeholder for such data, and should be in the message body for the producer. Likewise it will be returned in the body per search result for the consumer.</p><p>From <strong>Camel 2.16.0</strong> you can send raw data to Splunk by setting <strong><code>raw=true</code></strong> on the producer endpoint. This is useful for e.g., <strong><code>json/xml</code></strong> and other payloads where Splunk has build in support. </p><h3 id="Splunk-UseCases">Use Cases</h3><p>Search Twitter for tweets with music and publish events to Splunk</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[from("twitter://search?type=polling&keywords=music&delay=10&consumerKey=abc&consumerSecret=def&accessToken=hij&accessTokenSecret=xxx")
+ .convertBodyTo(SplunkEvent.class)
+ .to("splunk://submit?username=foo&password=bar&index=camel-tweets&sourceType=twitter&source=music-tweets");
]]></script>
-</div></div><p>To convert a Tweet to a SplunkEvent you could use a converter like</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><p>To convert a Tweet to a <strong><code>SplunkEvent</code></strong> you could use a converter like:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[@Converter
public class Tweet2SplunkEvent {
@Converter
public static SplunkEvent convertTweet(Status status) {
SplunkEvent data = new SplunkEvent("twitter-message", null);
- //data.addPair("source", status.getSource());
- data.addPair("from_user", status.getUser().getScreenName());
+
+ data.addPair("from_user", status.getUser().getScreenName());
data.addPair("in_reply_to", status.getInReplyToScreenName());
data.addPair(SplunkEvent.COMMON_START_TIME, status.getCreatedAt());
data.addPair(SplunkEvent.COMMON_EVENT_ID, status.getId());
data.addPair("text", status.getText());
data.addPair("retweet_count", status.getRetweetCount());
- if (status.getPlace() != null) {
+
+ if (status.getPlace() != null) {
data.addPair("place_country", status.getPlace().getCountry());
data.addPair("place_name", status.getPlace().getName());
data.addPair("place_street", status.getPlace().getStreetAddress());
}
+
if (status.getGeoLocation() != null) {
data.addPair("geo_latitude", status.getGeoLocation().getLatitude());
data.addPair("geo_longitude", status.getGeoLocation().getLongitude());
}
+
return data;
}
}
]]></script>
-</div></div><p>Search Splunk for tweets</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ from("splunk://normal?username=foo&password=bar&initEarliestTime=-2m&search=search index=camel-tweets sourcetype=twitter")
- .log("${body}");
+</div></div><p>Search Splunk for tweets:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[from("splunk://normal?username=foo&password=bar&initEarliestTime=-2m&search=search index=camel-tweets sourcetype=twitter")
+ .log("${body}");
]]></script>
-</div></div><h3 id="Splunk-Othercomments">Other comments</h3><p>Splunk comes with a variety of options for leveraging machine generated data with prebuilt apps for analyzing and displaying this. <br clear="none"> For example the jmx app. could be used to publish jmx attributes, eg. route and jvm metrics to Splunk, and displaying this on a dashboard.</p><p></p><h3 id="Splunk-SeeAlso">See Also</h3>
+</div></div><h3 id="Splunk-Comments">Comments</h3><p>Splunk comes with a variety of options for leveraging machine generated data with pre-built apps for analyzing and displaying this. For example the JMX app. could be used to publish JMX attributes, e.g., route and JVM metrics to Splunk, and displaying this on a dashboard.</p><p></p><h3 id="Splunk-SeeAlso">See Also</h3>
<ul><li><a shape="rect" href="configuring-camel.html">Configuring Camel</a></li><li><a shape="rect" href="component.html">Component</a></li><li><a shape="rect" href="endpoint.html">Endpoint</a></li><li><a shape="rect" href="getting-started.html">Getting Started</a></li></ul></div>
</td>
<td valign="top">