splunk/splunk-sdk-java splunk/splunk-sdk-java

  • Stars
    star
    138
  • Rank 264,508 (Top 6 %)
  • Language
    Java
  • License
    Apache License 2.0
  • Created over 13 years ago
  • Updated about 1 year ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
splunk/splunk-sdk-java
github

splunk

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Splunk Software Development Kit for Java

Java SDK Test

The Splunk Software Development Kit for Java

Version 1.9.5

The Splunk Software Development Kit (SDK) for Java contains library code and examples designed to enable developers to build applications using Splunk.

Splunk is a search engine and analytic environment that uses a distributed map-reduce architecture to efficiently index, search and process large time-varying data sets.

The Splunk product is popular with system administrators for aggregation and monitoring of IT machine data, security, compliance and a wide variety of other scenarios that share a requirement to efficiently index, search, analyze and generate real-time notifications from large volumes of time series data.

The Splunk developer platform enables developers to take advantage of the same technology used by the Splunk product to build exciting new applications that are enabled by Splunk's unique capabilities.

Getting started with the Splunk SDK for Java

The Splunk SDK for Java contains library code and examples that show how to programmatically interact with Splunk for a variety of scenarios including searching, saved searches, data inputs, and many more, along with building complete applications.

The information in this Readme provides steps to get going quickly, but for more in-depth information be sure to visit the Splunk Developer Portal.

Requirements

Here's what you need to get going with the Splunk SDK for Java.

Splunk

If you haven't already installed Splunk, download it here. For more about installing and running Splunk and system requirements, see Installing & Running Splunk. The Splunk SDK for Java has been tested with Splunk Enterprise 9.0 and 8.2.

Splunk SDK for Java

Get the Splunk SDK for Javaβ€”download the SDK as a ZIP, then extract the files and build the SDK. Or, download the JAR and add it to your project.

If you want to contribute to the SDK, clone the repository from GitHub.

Java using Maven

You can use Apache Maven to build your Splunk SDK for Java projects. With a few updates to your project's pom.xml file, it will retrieve all necessary dependencies and seamlessly build your project.

To add the Splunk SDK for Java .JAR file as a dependency:

  1. Add the repository to your project's pom.xml file:
<repositories>
  ...
  <repository>
    <id>splunk-artifactory</id>
    <name>Splunk Releases</name>
    <url>http://splunk.jfrog.io/splunk/ext-releases-local</url>
  </repository>
</repositories>
  1. Add the dependency to the pom.xml file:
<dependencies>
  ...
  <dependency>
    <groupId>com.splunk</groupId>
    <artifactId>splunk</artifactId>
    <version>1.9.5</version>
  </dependency>
</dependencies>

Be sure to update the version number to match the version of the Splunk SDK for Java that you are using.

Note: You can make similar changes to use Gradle as well.

Building the SDK and documentation

To build the SDK, open a command prompt in the /splunk-sdk-java directory and enter:

mvn

or

mvn package

This command builds all of the .class and .jar files. If you just want to build the .class files, enter:

mvn compile

To remove all build artifacts from the repository, enter:

mvn clean

To build the documentation for the SDK, it is being automatically generated with mvn package, otherwise enter:

cd splunk
mvn javadoc:javadoc

Usage

Login using username and password

import com.splunk.Service;
import com.splunk.ServiceArgs;

/**
 * Login using username and password
 */
public class SplunkLogin {

    static Service service = null;
    public static void main(String args[]) {
        ServiceArgs loginArgs = new ServiceArgs();
        loginArgs.setPort(8089);
        loginArgs.setHost("localhost");
        loginArgs.setScheme("https");
        loginArgs.setUsername("USERNAME"); // Use your username
        loginArgs.setPassword("PASSWORD"); // Use your password

        // Initialize the SDK client
        service = Service.connect(loginArgs);
    }
}

Login using Session Token

import com.splunk.Service;
import com.splunk.ServiceArgs;

/**
 * Login using Session token
 */
public class SplunkLogin {

    static Service service = null;
    /**
     * Session Token.
     * Actual token length would be longer than this token length.
     */
    static String token = "1k_Ostpl6NBe4iVQ5d6I3Ohla_U5";
    
    public static void main(String args[]) {
        ServiceArgs loginArgs = new ServiceArgs();
        loginArgs.setPort(8089);
        loginArgs.setHost("localhost");
        loginArgs.setScheme("https");
        loginArgs.setToken(String.format("Splunk %s", token));

        // Initialize the SDK client
        service = Service.connect(loginArgs);
    }
}
  • Login using username and password will create Session token internally.
  • Login using Credentials (username & password) OR directly using Session token are similar.
  • In above two approaches, there is one limitation that expiration time of Session token cannot be extended. User has to re-login every time when token expires.
  • To overcome this limitation, Authentication token is used instead of Session token.
  • In Authentication token, user has a provision to set token expiration time. Splunk allows user to set relative/absolute time for token expiration.
  • In other words, Authentication token is configurable whereas Session token cannot be configured.

Login using Authentication Token (RECOMMENDED)

import com.splunk.Service;
import com.splunk.ServiceArgs;

/**
 * Login using Authentication token
 */
public class SplunkLogin {

    static Service service = null;
    /**
     * Authentication Token.
     * Actual token length would be longer than this token length.
     */
    static String token = "1k_Ostpl6NBe4iVQ5d6I3Ohla_U5";
    
    public static void main(String args[]) {
        ServiceArgs loginArgs = new ServiceArgs();
        loginArgs.setPort(8089);
        loginArgs.setHost("localhost");
        loginArgs.setScheme("https");
        loginArgs.setToken(String.format("Bearer %s", token));

        // Initialize the SDK client
        service = Service.connect(loginArgs);
    }
}

Example of running a simple search by first creating the search job

import com.splunk.Job;
import com.splunk.ResultsReader;
import com.splunk.ResultsReaderXml;
import com.splunk.Service;
import com.splunk.ServiceArgs;

/**
 * Logged in using Authentication token.
 * Assuming that authentication token is already created from Splunk web.
 * Create Job using search creation.
 * Read results and print _raw fields
 */
public class SearchExample {

    static Service service = null;

    /**
     * Authentication Token.
     * Actual token length would be longer than this token length.
     */
    static String token = "1k_Ostpl6NBe4iVQ5d6I3Ohla_U5";
    
    public static void main(String args[]) {

        ServiceArgs loginArgs = new ServiceArgs();
        loginArgs.setPort(8089);
        loginArgs.setHost("localhost");
        loginArgs.setScheme("https");
        loginArgs.setToken(String.format("Bearer %s", token));

        // Initialize the SDK client
        service = Service.connect(loginArgs);

        // Run a simple search by first creating the search job
        Job job = service.getJobs().create("search index=_internal | head 10");

        // Waiting for search results to be ready
        while (!job.isReady()) {
            try {
                Thread.sleep(500); // 500 ms
            } catch (Exception e) {
                // Handle exception here.
            }
        }

        // Read results
        try {
            ResultsReader reader = new ResultsReaderXml(job.getEvents());

            // Iterate over events and print _raw field
            reader.forEach(event -> System.out.println(event.get("_raw")));

        } catch (Exception e) {
            // Handle exception here.
        }
    }
}

For more information on authentication using tokens, please visit Splunk Docs.

Unit tests

The Splunk SDK for Java includes several unit tests that are run at the command line.

Set up the .splunkrc file

To connect to Splunk, many of the SDK examples and unit tests take command-line arguments that specify values for the host, port, and login credentials for Splunk. For convenience during development, you can store these arguments as key-value pairs in a text file named .splunkrc. Then, the SDK examples and unit tests use the values from the .splunkrc file when you don't specify them.

To use this convenience file, create a text file with the following format:

# Splunk host (default: localhost)
host=localhost
# Splunk admin port (default: 8089)
port=8089
# Splunk username
username=admin
# Splunk password
password=changeme
# Access scheme (default: https)
scheme=https
# Your version of Splunk (default: 5.0)
version=5.0

Save the file as .splunkrc in the current user's home directory.

  • For example, on Mac OS X, save the file as:

    ~/.splunkrc

  • On Windows, save the file as:

    C:\Users\currentusername\.splunkrc

    You might get errors in Windows when you try to name the file because ".splunkrc" looks like a nameless file with an extension. You can use the command line to create this fileβ€”go to the C:\Users\currentusername directory and enter the following command:

    Notepad.exe .splunkrc

    Click Yes, then continue creating the file.

Note: Storing login credentials in the .splunkrc file is only for convenience during development. This file isn't part of the Splunk platform and shouldn't be used for storing user credentials for production. And, if you're at all concerned about the security of your credentials, just enter them at the command line rather than saving them in this file.

Run unit tests

To run the SDK unit tests, open a command prompt in the /splunk-sdk-java directory and enter:

mvn test

You can also run specific test classes by passing the class to the -Dtest= option, e.g.,

mvn test -Dtest=AtomFeedTest

The maven configuration can also produce an HTML report of all the tests automatically when mvn package / mvn test are executed. Alternate way to generate report is using below command under splunk directory:

mvn jacoco:report

The report will be written in /splunk-sdk-java/splunk/target/site/surefire-report.html.

It's also possible to run the units within Java IDEs such as IntelliJ and Eclipse. For example, to open the Splunk SDK for Java project in Eclipse:

  1. Click File, Import.
  2. Click General, Existing Projects into Workspace, then click Next.
  3. In Select root directory, type the path to the Splunk SDK for Java root directory (or click Browse to locate it), then click Finish.

Measure code coverage

Measurement of code coverage is generated along with mvn package / mvn test:

mvn jacoco:report

To view the coverage report, open /splunk-sdk-java/splunk/target/test-report/index.html in your web browser.

Repository

/argsGenerator This directory is created by the build and contains intermediate build ouputs
/splunk/target This directory is created by the build and contains intermediate build ouputs
/splunk/src/main Source for com.splunk
/splunk/src/test Source for unit tests

Changelog

The CHANGELOG.md file in the root of the repository contains a description of changes for each version of the SDK. You can also find it online at https://github.com/splunk/splunk-sdk-java/blob/master/CHANGELOG.md.

Branches

The master branch always represents a stable and released version of the SDK. You can read more about our branching model on our Wiki at https://github.com/splunk/splunk-sdk-java/wiki/Branching-Model.

Documentation and resources

If you need to know more:

Community

Stay connected with other developers building on Splunk.

Email [email protected]
Issues https://github.com/splunk/splunk-sdk-java/issues/
Answers http://splunk-base.splunk.com/tags/java/
Blog http://blogs.splunk.com/dev/
Twitter @splunkdev

How to contribute

If you would like to contribute to the SDK, go here for more information:

Support

  1. You will be granted support if you or your company are already covered under an existing maintenance/support agreement. Send an email to [email protected] and include "Splunk SDK for Java" in the subject line.

  2. If you are not covered under an existing maintenance/support agreement, you can find help through the broader community at:

  3. Splunk will NOT provide support for SDKs if the core library (the code in the splunk directory) has been modified. If you modify an SDK and want support, you can find help through the broader community and Splunk answers (see above). We would also like to know why you modified the core libraryβ€”please send feedback to [email protected].

  4. File any issues on GitHub.

Contact Us

You can reach the Developer Platform team at [email protected].

License

The Splunk Java Software Development Kit is licensed under the Apache License 2.0. Details can be found in the LICENSE file.

More Repositories

1

attack_range

A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk
Jinja
2,118
star
2

security_content

Splunk Security Content
Python
1,235
star
3

splunk-sdk-python

Splunk Software Development Kit for Python
Python
649
star
4

attack_data

A repository of curated datasets from various attacks
Python
560
star
5

docker-splunk

Splunk Docker GitHub Repository
Python
410
star
6

splunk-ansible

Ansible playbooks for configuring and managing Splunk Enterprise and Universal Forwarder deployments
Python
355
star
7

eventgen

Splunk Event Generator: Eventgen
Python
354
star
8

botsv2

Splunk Boss of the SOC version 2 dataset.
348
star
9

splunk-connect-for-kubernetes

Helm charts associated with kubernetes plug-ins
Python
344
star
10

docker-splunk-legacy

Docker Splunk *** LEGACY IMAGES - PLEASE SEE https://github.com/splunk/docker-splunk INSTEAD ***
Shell
304
star
11

botsv1

302
star
12

pion

Pion Network Library (Boost licensed open source)
C++
299
star
13

splunk-operator

Splunk Operator for Kubernetes
Go
205
star
14

splunk-sdk-javascript

Splunk Software Development Kit for JavaScript
JavaScript
185
star
15

botsv3

Splunk Boss of the SOC version 3 dataset.
163
star
16

melting-cobalt

A Cobalt Strike Scanner that retrieves detected Team Server beacons into a JSON object
Python
163
star
17

qbec

configure kubernetes objects on multiple clusters using jsonnet
Go
157
star
18

splunk-connect-for-syslog

Splunk Connect for Syslog
Python
152
star
19

splunk-library-javalogging

Splunk logging appenders for popular Java Logging frameworks
Java
131
star
20

ansible-role-for-splunk

Splunk@Splunk's Ansible role for installing Splunk, upgrading Splunk, and installing apps/addons on Splunk deployments (VM/bare metal)
Jinja
131
star
21

attack_range_local

Build a attack range in your local machine
Jinja
129
star
22

splunk-platform-automator

Ansible framework providing a fast and simple way to spin up complex Splunk environments.
Python
117
star
23

SA-ctf_scoreboard

Python
116
star
24

splunk-aws-cloudformation

AWS CloudFormation templates for Splunk distributed cluster deployment
Shell
108
star
25

terraform-provider-splunk

Terraform Provider for Splunk
Go
103
star
26

securitydatasets

Home for Splunk security datasets.
97
star
27

splunk-aws-project-trumpet

Python
95
star
28

splunk-app-examples

App examples for Splunk Enterprise
JavaScript
93
star
29

splunk-demo-collector-for-analyticsjs

Example Node.js based backend collector for client-side data
JavaScript
93
star
30

vscode-extension-splunk

Visual Studio Code Extension for Splunk
Python
86
star
31

observability-workshop

To get started, please proceed to The Splunk Observability Cloud Workshop Homepage.
HTML
86
star
32

mltk-algo-contrib

Python
85
star
33

fluent-plugin-splunk-hec

This is the Fluentd output plugin for sending events to Splunk via HEC.
Ruby
83
star
34

network-explorer

C++
82
star
35

kafka-connect-splunk

Kafka connector for Splunk
Java
82
star
36

splunk-javascript-logging

Splunk HTTP Event Collector logging interface for JavaScript
JavaScript
81
star
37

splunk-reskit-powershell

Splunk Resource Kit for Powershell
PowerShell
80
star
38

corona_virus

This project includes an app that allows users to visualize and analyze information about COVID-19 using data made publicly-available by Johns Hopkins University. For more information on legal disclaimers, please see the README.
Python
79
star
39

contentctl

Splunk Content Control Tool
Python
77
star
40

salo

Synthetic Adversarial Log Objects: A Framework for synthentic log generation
Python
75
star
41

ShellSweep

ShellSweeping the evil.
PowerShell
73
star
42

docker-itmonitoring

Get Started with Streaming your Docker Logs and Stats in Splunk!
HTML
68
star
43

splunk-sdk-csharp-pcl

Splunk's next generation C# SDK
C#
65
star
44

docker-logging-plugin

Splunk Connect for Docker is a Docker logging plugin that allows docker containers to send their logs directly to Splunk Enterprise or a Splunk Cloud deployment.
Go
64
star
45

attack-detections-collector

Collects a listing of MITRE ATT&CK Techniques, then discovers Splunk ESCU detections for each technique
Python
59
star
46

splunk-aws-serverless-apps

Splunk AWS Serverless applications and Lambda blueprints
JavaScript
55
star
47

splunk-webframework

Splunk Web Framework
Python
51
star
48

splunk-app-splunkgit

GitHub App
Python
49
star
49

vault-plugin-secrets-gitlab

Vault Plugin for Gitlab Project Access Token
Go
48
star
50

pytest-splunk-addon

A Dynamic test tool for Splunk Technology Add-ons
Python
47
star
51

splunk-mltk-container-docker

Splunk App for Data Science and Deep Learning - container images repository
Jupyter Notebook
47
star
52

rba

RBA is Splunk's method to aggregate low-fidelity security events as interesting observations tagged with security metadata to create high-fidelity, low-volume alerts.
44
star
53

splunk-cloud-sdk-go

The Splunk Cloud SDK for Go, contains libraries for building apps for the Splunk Cloud Services Platform.
Go
43
star
54

splunk-app-testing

sample app along with a CICD pipeline for testing multiple versions of splunk
Shell
42
star
55

rwi_executive_dashboard

Splunk Remote Work Insights - Executive Dashboard
HTML
38
star
56

splunk-sdk-ruby

Splunk Software Development Kit for Ruby
Ruby
36
star
57

splunk-shuttl

Splunk app for archive management, including HDFS support.
Java
35
star
58

attack_range_cloud

Attack Range to test detection against nativel serverless cloud services and environments
Python
35
star
59

addonfactory-ucc-generator

A framework to generate UI-based Splunk Add-ons.
Python
34
star
60

splunk-for-securityHub

Python
34
star
61

azure-functions-splunk

Azure Functions for getting data in to Splunk
JavaScript
30
star
62

dashboard-conf19-examples

Splunk new dashboard framework examples .conf 2019
JavaScript
30
star
63

github_app_for_splunk

A collection of dashboards and knowledge objects for Github data
JavaScript
29
star
64

splunk-connect-for-snmp

Python
28
star
65

twinclams

because twin clams are better than one clam?
Python
27
star
66

jupyterhub-istio-proxy

JupyterHub proxy implementation for kubernetes clusters running istio service mesh
Go
27
star
67

observability-content-contrib

Contribution repository for Splunk Observability Content (e.g. Dashboards, Detectors, Examples, etc)
HCL
26
star
68

lightproto

Protobuf compatible code generator
Java
26
star
69

splunk-app-twitter

Twitter application for Splunk
Python
25
star
70

splunk-library-dotnetlogging

Support for logging from .NET Tracing and ETW / Semantic Logging ApplicationBlock to Splunk.
C#
25
star
71

splunkrepl

An awesome little REPL for issuing SPLUNK queries
JavaScript
24
star
72

fluent-plugin-kubernetes-objects

This is the Fluentd input plugin which queries Kubernetes API to collect Kubernetes objects (like Nodes, Namespaces, Pods, etc.)
Ruby
23
star
73

splunk-ref-pas-code

Splunk Reference App - Pluggable Auditing System (PAS) - Code Repo
Python
22
star
74

vault-plugin-splunk

Vault plugin to securely manage Splunk admin accounts and password rotation
Go
22
star
75

splunk-sdk-php

Splunk Software Development Kit for PHP
PHP
22
star
76

splunk-heatwave-viz

A heatmap vizualization of bucketed ranged data over time.
JavaScript
21
star
77

pipelines

Concurrent processing pipelines in Go.
Go
21
star
78

splunk-gcp-functions

Python
20
star
79

PEAK

Security Content for the PEAK Threat Hunting Framework
Jupyter Notebook
20
star
80

splunk-tableau-wdc

Splunk Tableau Web Data Connector (WDC) Example
JavaScript
20
star
81

splunkforjenkins

Java
19
star
82

splunk-3D-graph-network-topology-viz

Plot relationships between objects with force directed graph based on ThreeJS/WebGL.
JavaScript
19
star
83

minecraft-app

Splunking Minecraft with the App Framework
JavaScript
19
star
84

splunk-add-on-jira-alerts

Splunk custom alert action for Atlassian JIRA
Python
19
star
85

terraform-provider-scp

Splunk Terraform Provider to manage config resources for Splunk Cloud Platform
Go
18
star
86

splunk-bunyan-logger

A Bunyan stream for Splunk's HTTP Event Collector
JavaScript
18
star
87

slack-alerts

Splunk custom alert action for sending messages to Slack channels
Python
18
star
88

public-o11y-docs

Splunk Observability Cloud docs
HTML
18
star
89

dashpub

Generate next.js apps to publish Splunk dashboards
JavaScript
18
star
90

vale-splunk-style-guide

Splunk Style Guide for the Vale linter
18
star
91

SA-ctf_scoreboard_admin

Python
18
star
92

acs-privateapps-demo

Demo of private-apps ci/cd integration into splunkcloud using the admin config service
Go
17
star
93

splunk-cloud-sdk-python

The Splunk Cloud SDK for Python, contains libraries for building apps for the Splunk Cloud Services Platform.
Python
17
star
94

fabric-logger

Logs blocks, transactions and events from Hyperledger Fabric to Splunk.
TypeScript
17
star
95

deep-learning-toolkit

Deep Learning Toolkit for Splunk
Python
15
star
96

k8s-yaml-patch

jsonnet library to patch objects loaded from yaml
Go
15
star
97

acs-cli

Admin Config Service CLI
15
star
98

TA-osquery

A Splunk technology add-on for osquery
14
star
99

ml-toolkit-docs

ML Toolkit & Showcase application documents
14
star
100

splunk-sdk-csharp

Splunk Software Development Kit for CSharp
C#
14
star