Following the dev page "Create a Lambda function in Java" for HEC, why am I unable to locate the logs in Splunk?

[San55240]

I followed http://dev.splunk.com/view/event-collector/SP-CAAAE62 for HTTP Event Collector and am able to run successfully through Eclipse which I can see the input what I passed and it got resulted in the console, but I was not able to see the same input in Splunk. I used same log4j2 as mentioned and gave the Splunk host and token.

My log4j looks like,

    <Http name="http" 
        url="https://http-inputs-******-ma.splunkcloud.com/services/collector/event"
        token="*******-***-****-****-**********"
        disableCertificateValidation="true" batch_size_count="1">
        <PatternLayout pattern="%m" />
    </Http>
</Appenders>

Note : I did test the same with curl. It works and I can see the message.

[gblock_splunk]

@San55240, try removing "/services/collector/event" for the url, the logging library sets this. I noticed you did not set the port, is your HEC instance on port 80?

[San55240]

@gblock I tried removing "/services/collector/event", Still not able to see the logs in Splunk. Yes ,My HEC instance port is running on 80.

It worked when I tried same host and token by curl. Did anyone tried this eclipse example

[gblock_splunk]

Can you show me a gist of the code in your lambda?

[gblock_splunk]

Also did you check the lambda logs to see if there was an error?

[San55240]

https://github.com/santhoshjoy/hellolambda.git

[gblock_splunk]

I created the original Eclipse example, so I know it can work as I had a working version which I passed off to our docs team. This is against a managed Splunk cloud instance yes?

[gblock_splunk]

Here's a screenshot from when I had this working. You can see the code and the Splunk event on the other side.

https://www.dropbox.com/s/948pvvqkqser7s0/Lambda.png?dl=0

[gblock_splunk]

Also, can you try specifying port 80 explicitly?

[gblock_splunk]

For sure it should not have /services/collector in the url.

[Jeremiah]

So you are testing from Eclipse and you're not seeing anything getting posted? Can you verify that your code tried to connect to your event collector endpoint?

[San55240]

@Jeremiah I can able to see the output in my Eclipse console but not in Splunk. Your ask about "try to connect to your event collector", I just done the same way what the url mentioned seems the connection between my code and HEC is not happening through log4j2. Do you know any other way to test and see the connection is happening in java.