Entaxy Docs

Splunk HEC

Since Camel 3.3

Only producer is supported

The Splunk HEC component allows to send data to Splunk using the HTTP Event Collector.

Maven users will need to add the following dependency to their pom.xml for this component:

 <dependency>
        <groupId>org.apache.camel</groupId>
        <artifactId>camel-splunk-hec</artifactId>
        <version>${camel-version}</version>
</dependency>

URI format

  splunk-hec:[endpoint]/[token]?[options]

The Splunk HEC component supports 2 options, which are listed below.

Name Description Default Type

lazyStartProducer (producer)

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

boolean

basicPropertyBinding (advanced)

Whether the component should use basic property binding (Camel 2.x) or the newer property binding with additional capabilities

false

boolean

The Splunk HEC endpoint is configured using URI syntax:

splunk-hec:splunkURL/token

with the following path and query parameters:

Path Parameters (2 parameters):

Name Description Default Type

splunkURL

Required Splunk Host URL

String

token

Required Splunk authorization token

String

Query Parameters (9 parameters):

Name Description Default Type

host (producer)

Splunk host.

String

index (producer)

Splunk index to write to

camel

String

lazyStartProducer (producer)

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

boolean

source (producer)

Splunk source argument

camel

String

sourceType (producer)

Splunk sourcetype argument

camel

String

basicPropertyBinding (advanced)

Whether the endpoint should use basic property binding (Camel 2.x) or the newer property binding with additional capabilities

false

boolean

synchronous (advanced)

Sets whether synchronous processing should be strictly used, or Camel is allowed to use asynchronous processing (if supported).

false

boolean

https (security)

Contact HEC over https.

true

boolean

skipTlsVerify (security)

Splunk HEC TLS verification.

false

boolean

Message body

The body must be serializable to JSON so it may be sent to Splunk.

A String or a java.util.Map object can be serialized easily.

Use Cases

The Splunk HEC endpoint may be used to stream data to Splunk for ingestion.

It is meant for high volume ingestion of machine data.