Splunk Search

Search result Not consistent

balesh
New Member

Hello Folks,

I am new to splunk SDK and i am trying to write a code that search and return a search result from the splunk log instantly.
I am using splunk sdk for java to connect and fecth the details from logs.
below is what i am trying to achieve:
- Run a transaction in my application (which is configured with splunk)
- search for a keyword in the log after the transaction is completed.

below the code that i used to connect to splunk:

private static Service connectToSplunk() {
    try {
      if(splunkService== null) {
        loadSplunkPropertiesValues();
        HttpService.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2);
        ServiceArgs loginArgs = new ServiceArgs();
        loginArgs.setUsername(properties.getProperty("splunkLoginUserId"));
        loginArgs.setPassword(properties.getProperty("splunkLoginPassword"));
        loginArgs.setHost(properties.getProperty("splunkHost"));
        loginArgs.setPort(Integer.valueOf(properties.getProperty("splunkPort")));
        splunkService = Service.connect(loginArgs);
      }
      return splunkService;
    }
    catch(Exception e) {

    }
  }

  below function to get the details from the splunk:

  private static String getLogDetailsFromSplunk( Service service , String keyword)  {

    JobArgs jobArgs = new JobArgs();
   jobArgs.setExecutionMode(JobArgs.ExecutionMode.NORMAL);
    jobArgs.setEarliestTime(properties.getProperty("jobArgsEarliestTime"));
    jobArgs.setLatestTime(properties.getProperty("jobArgsLatestTime"));
    jobArgs.setStatusBuckets(300);
    String sql ="search sourcetype=emsa_main source="*/logs/cuor-instrument-lifecycle-manager-*" | search msg="BDD Test for database retry queue:database:*" | head 10";
    Job job = service.getJobs().create(sql, jobArgs);

    StringBuffer strLog = new StringBuffer("");
    String strLogAll = null;
    // checking if the job is completed
    while (!job.isDone()) {
      try {
        Thread.sleep(500);
      } catch (Exception e) {

      }
    }
    try{
      Args outputArgs = new Args();
      outputArgs.put("output_mode","json");
      InputStream stream = job.getResults(outputArgs);
      byte[] buffer = new byte[100000];
      while(stream.read(buffer)!=-1)
        strLogAll =new String(buffer);
      //System.out.println(strLogAll);
        //strLog.append(new String(buffer));
    }
    catch(Exception  ne) {
    }

    return strLogAll;
  }

Using the above code, i am able to get the details from the log/splunk. The concern that i am facing is that sometimes, the keyword that i am looking for is found in the result returned, sometimes not.
I am trying to figure out what is the possible causes. i had set the earliest_time to 45 seconds(which is a requirement). Could anyone give me some clue on what could be the possible reasons. A feedback or suggestion would be really appreciated.

Thanks

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...