Splunk Dev

fail to connect with java sdk

perseger
Explorer

Hi,

I'm trying to connect to Splunk API through java sdk, but get stuck when creating a job.

// Create a map of arguments and add login parameters
    ServiceArgs loginArgs = new ServiceArgs();
    loginArgs.setHost("localhost");
    loginArgs.setPort(8089);

    // Connect to Splunk
    Service service = Service.connect(loginArgs);

    JobArgs jobargs = new JobArgs();
    jobargs.setExecutionMode(JobArgs.ExecutionMode.NORMAL);
    JobCollection jobs = service.getJobs();
    Job job = jobs.create("search * | head 5", jobargs); // <<--- this fails

    // Wait for the search to finish
    while (!job.isDone()) {
        try {
            Thread.sleep(500);
        } catch (InterruptedException e) {
            throw new RuntimeException(e);
        }
    }

    // Get the search results 
    try (InputStream resultsNormalSearch = job.getResults()) {
        String inputStreamString = new Scanner(resultsNormalSearch, "UTF-8").useDelimiter("\\A").next();
        System.out.println(inputStreamString);
    } catch (IOException e) {
        e.printStackTrace();  //To change body of catch statement use File | Settings | File Templates.
    }

I'm running Splunk Java SDK 1.2, Splunk Free licence 6.0, Java 7, Windows 7

It works in Splunk 5.0.4 but running against Splunk 6 I get the following error:

[Fatal Error] :1:3: Dokumentets kodtext före rotelementet måste vara välformulerad. --> in english --> Document code text before the root element must be well-formed.

Exception in thread "main" com.splunk.HttpException: HTTP 400
    at com.splunk.HttpException.create(HttpException.java:59)
    at com.splunk.HttpService.send(HttpService.java:355)
    at com.splunk.Service.send(Service.java:1203)
    at com.splunk.HttpService.post(HttpService.java:212)
    at com.splunk.JobCollection.create(JobCollection.java:79)
    at com.splunk.JobCollection.create(JobCollection.java:111)
    at se.lul.fris.splunkpinger.Main2.main(Main2.java:28)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:601)
    at com.intellij.rt.execution.application.AppMain.main(AppMain.java:120)

Does anyone know what's wrong?
Thanks

Tags (2)

npbala_22
Explorer

Still Getting same error.. Can you resolve this

erritesh17
Path Finder

Hi ,
Here I will resolve that issue ,
Follow that step

public class SplunkConnection {

public String secureConnection() throws JSONException, IOException{

 HttpService.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2);

    Map <String,Object> connectionArgs = new HashMap<String,Object>();
    connectionArgs.put("host", "DEVELOPMENT");
    connectionArgs.put("username", "admin");
    connectionArgs.put("password", "*****");
    connectionArgs.put("port", 8089);
    connectionArgs.put("scheme", "https");
    Service splunkService = Service.connect(connectionArgs);
    Args queryArgs = new Args();
    queryArgs.put("earliest_time","0");
    queryArgs.put("latest_time","now");
Job job = splunkService.getJobs().create("search index=*");
while(!job.isDone()){
    try{
        Thread.sleep(500);
    }catch (Exception exp){
        exp.printStackTrace();
    }
}
try{
    Args outputArgs = new Args();
    outputArgs.put("output_mode", "json");
    InputStream inputStream = job.getResults(outputArgs);
    byte[] buffer = new byte[4096];
    String json= "";
    while(inputStream.read(buffer)!= -1){
        json = new String(buffer);
        logger.info(json );     
    }
    return json;

} catch(Exception e){
    e.printStackTrace();
}
    return null;
}

}
Thank you,
If you get any issue please let me know.

bgadsk
New Member

Did you end up fixing this issue? If so, how? I am facing the same issue now.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...