Splunk HEC

The splunk component allows publishing events in Splunk using the HTTP Event Collector.

Metadata

Property	Value
Scheme	`splunk-hec`
Support Level	Stable
Labels	monitoring
Version	4.10.2

Maven Dependency

<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-splunk-hec</artifactId>
    <version>4.10.2</version>
</dependency>

Endpoint Properties

Name	Type	Required	Default	Description
`splunkURL`	string	✓		Splunk Host and Port (example: my_splunk_server:8089)
`bodyOnly`	boolean		`false`	Send only the message body
`headersOnly`	boolean		`false`	Send only message headers
`host`	string			Splunk host field of the event message. This is not the Splunk host to connect to.
`index`	string		`camel`	Splunk index to write to
`source`	string		`camel`	Splunk source argument
`sourceType`	string		`camel`	Splunk sourcetype argument
`splunkEndpoint`	string		`/services/collector/event`	Splunk endpoint Defaults to /services/collector/event To write RAW data like JSON use /services/collector/raw For a list of all endpoints refer to splunk documentation (HTTP Event Collector REST API endpoints) Example for Spunk 8.2.x: https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Data/HECRESTendpoints To extract timestamps in Splunk8.0 /services/collector/eventauto_extract_timestamp=true Remember to utilize RAW{} for questionmarks or slashes in parameters.
`sslContextParameters`	object			SSL configuration
`time`	integer			Time this even occurred. By default, the time will be when this event hits the splunk server.
`lazyStartProducer`	boolean		`false`	Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.
`https`	boolean		`true`	Contact HEC over https.
`skipTlsVerify`	boolean		`false`	Splunk HEC TLS verification.
`token`	string	✓		Splunk HEC token (this is the token created for HEC and not the user's token)