[[splunk-hec-component]]
= Splunk HEC Component
//THIS FILE IS COPIED: EDIT THE SOURCE FILE:
:page-source: components/camel-splunk-hec/src/main/docs/splunk-hec-component.adoc
:docTitle: Splunk HEC
:artifactId: camel-splunk-hec
:description: The splunk component allows to publish events in Splunk using the HTTP Event Collector.
:since: 3.3
:supportLevel: Stable
:component-header: Only producer is supported
include::{cq-version}@camel-quarkus:ROOT:partial$reference/components/splunk-hec.adoc[opts=optional]

*Since Camel {since}*

*{component-header}*

The Splunk HEC component allows to send data to Splunk using the
https://dev.splunk.com/enterprise/docs/dataapps/httpeventcollector/[HTTP Event Collector].

Maven users will need to add the following dependency to their pom.xml
for this component:

[source,xml]
---------------------------------------------
 <dependency>
        <groupId>org.apache.camel</groupId>
        <artifactId>camel-splunk-hec</artifactId>
        <version>${camel-version}</version>
</dependency>
---------------------------------------------

== URI format

[source,java]
-------------------------------
  splunk-hec:[endpoint]/[token]?[options]
-------------------------------


// component options: START
The Splunk HEC component supports 2 options, which are listed below.



[width="100%",cols="2,5,^1,2",options="header"]
|===
| Name | Description | Default | Type
| *lazyStartProducer* (producer) | Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing. | false | boolean
| *autowiredEnabled* (advanced) | Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc. | true | boolean
|===
// component options: END



// endpoint options: START
The Splunk HEC endpoint is configured using URI syntax:

----
splunk-hec:splunkURL/token
----

with the following path and query parameters:

=== Path Parameters (2 parameters):


[width="100%",cols="2,5,^1,2",options="header"]
|===
| Name | Description | Default | Type
| *splunkURL* | *Required* Splunk Host URL |  | String
| *token* | *Required* Splunk authorization token |  | String
|===


=== Query Parameters (10 parameters):


[width="100%",cols="2,5,^1,2",options="header"]
|===
| Name | Description | Default | Type
| *bodyOnly* (producer) | Send only the message body | false | boolean
| *headersOnly* (producer) | Send only message headers | false | boolean
| *host* (producer) | Splunk host. |  | String
| *index* (producer) | Splunk index to write to | camel | String
| *lazyStartProducer* (producer) | Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing. | false | boolean
| *source* (producer) | Splunk source argument | camel | String
| *sourceType* (producer) | Splunk sourcetype argument | camel | String
| *time* (producer) | Time this even occurred. By default, the time will be when this event hits the splunk server. |  | Long
| *https* (security) | Contact HEC over https. | true | boolean
| *skipTlsVerify* (security) | Splunk HEC TLS verification. | false | boolean
|===
// endpoint options: END

== Message Headers

[width="100%",cols="10%,20%,70%",options="header",]
|=======================================================================
|Name |Type |Description

|`SplunkHECConstants.INDEX_TIME` |`Long` | Epoch-formatted time.
Specify with the time query string parameter. Sets a default for all events in the request.
The default time can be overridden.

|=======================================================================

== Message body
The body must be serializable to JSON so it may be sent to Splunk.

A `String` or a `java.util.Map` object can be serialized easily.

== Use Cases
The Splunk HEC endpoint may be used to stream data to Splunk for ingestion.

It is meant for high volume ingestion of machine data.

== Configuring the index time

By default, the index time for an event is when the event makes it to the Splunk
server.

[source,java]
-------------------------------
from("direct:start")
        .to("splunk-hec://localhost:8080?token");
-------------------------------

If you are ingesting a large enough dataset with a big enough lag then the time
the event hits the server and when that event actually happened could be skewed. If
you want to override the index time you can do so.

[source,java]
-------------------------------
from("kafka:logs")
        .setHeader(SplunkHECConstants.INDEX_TIME, simple("${headers[kafka.HEADERS].lastKey('TIME')}"))
        .to("splunk-hec://localhost:8080/token");
-------------------------------

[source,java]
-------------------------------
from("kafka:logs")
        .toD("splunk-hec://localhost:8080/token?time=${headers[kafka.HEADERS].lastKey('TIME')}");
-------------------------------


include::{page-component-version}@camel-spring-boot::page$splunk-starter.adoc[]
