Uable to connect Splunk using java sdk

Question

I am trying to connect Splunk using Java SDK but i am getting Connection Refused Exception.

     Map<String, Object> connectionArgs = new HashMap<String, Object>();
     connectionArgs.put("host", "mydomain.com");
     connectionArgs.put("username", "admin");
     connectionArgs.put("password", "passxxx");
     connectionArgs.put("port", 8089);
     connectionArgs.put("scheme", "https");
     Service splunkService = Service.connect(connectionArgs); 

When I am using the browser with the above url i, e, https://mydomain.com i am able to login with the above credentials but through Java sdk i am not able to connect. I debugged the code, In HttpService.java class the URL is getting constructed as https://mydomain.com:8089/services/auth/login

I am not getting why the URL is getting constructed like this. Kindly help me out in resolving the issue at the earliest. Thanks

Answer 1

The SPLUNK SDKs have some nasty bugs. Try to use CURL via BASH to get data from SPLUNK Rest API. It looks complicated, but works well. You will speedup your development and your debugging time.

The following snippet works well:

SPLUNK_API="https://splunk.you.de:8089/services/search"
curl -s -k -u user:password $SPLUNK_API/jobs -d output_mode=csv --data-urlencode 'search=search  sourcetype="tomcat-access.log"  RC>0  | timechart avg(runtime) by xyz ' -d earliest_time=$START_TIME -d latest_time=$END_TIME -d exec_mode=oneshot -o splunk-responsetime.csv

Answer 2

I am not getting why the URL is getting constructed like this.

Well, This is because the Service.login(String username, String password) method in splunk.jar has this as hard-coded:

ResponseMessage response = post("/services/auth/login", args);

If you want to change the URL, you should download the splunk SDK from here , change the URL, create a jar and use it in your project.

OR

You can create your own class which extends Service class and then override the methods you want.