Spring Integration Splunk Adapter

The SI adapter includes Outbound Channel Adapter and Inbound Channel Adapter.

Inbound channel adapter :

Inbound channel adapter is used to get data out of Splunk and put into Spring Integration's channel. There are 5 ways to get data out of Splunk:

• Blocking
• Non blocking
• Saved search
• Realtime
• Export

Blocking search:

	<int-splunk:inbound-channel-adapter id="splunkInboundChannelAdapter"
		auto-startup="true" search="search spring:example"
		splunk-server-ref="splunkServer"
		channel="inputFromSplunk" mode="blocking" earliestTime="-1d" latestTime="now" initEarliestTime="-1d">
		<int:poller fixed-rate="5" time-unit="SECONDS"/>
	</int-splunk:inbound-channel-adapter>

Non blocking search:

	<int-splunk:inbound-channel-adapter id="splunkInboundChannelAdapter"
		auto-startup="true" search="search spring:example"
		splunk-server-ref="splunkServer"
		channel="inputFromSplunk" mode="normal" earliestTime="-1d" latestTime="now" initEarliestTime="-1d">
		<int:poller fixed-rate="5" time-unit="SECONDS"/>
	</int-splunk:inbound-channel-adapter>

Saved search:

	<int-splunk:inbound-channel-adapter id="splunkInboundChannelAdapter"
		auto-startup="true" savedSearch="test" splunk-server-ref="splunkServer"
		channel="inputFromSplunk" mode="saved" earliestTime="-1d" latestTime="now" initEarliestTime="-1d">
		<int:poller fixed-rate="5" time-unit="SECONDS"/>
	</int-splunk:inbound-channel-adapter>

Realtime search:

	<int-splunk:inbound-channel-adapter id="splunkInboundChannelAdapter"
		auto-startup="true" search="search spring:example" splunk-server-ref="splunkServer" channel="inputFromSplunk"
		mode="realtime" earliestTime="-5s" latestTime="rt" initEarliestTime="-1d">
		<int:poller fixed-rate="5" time-unit="SECONDS"/>
	</int-splunk:inbound-channel-adapter>

Export:

	<int-splunk:inbound-channel-adapter id="splunkInboundChannelAdapter"
		auto-startup="true" search="search spring:example" splunk-server-ref="splunkServer" channel="inputFromSplunk"
		mode="export" earliestTime="-5d" latestTime="now" initEarliestTime="-1d">
		<int:poller fixed-rate="5" time-unit="SECONDS"/>
	</int-splunk:inbound-channel-adapter>

Outbound channel adapter:

Outbound channel adapter is used to put data into Splunk from channels in Spring Integration. There are 3 kinds of method to put data

• REST(submit)
• stream
• tcp

Submit:

	<int-splunk:outbound-channel-adapter
		id="splunkOutboundChannelAdapter" auto-startup="true" order="1"
		channel="outputToSplunk"
		splunk-server-ref="splunkServer" pool-server-connection="true"
		sourceType="spring-integration" source="example2" ingest="submit">
	</int-splunk:outbound-channel-adapter>

Stream:

	<int-splunk:outbound-channel-adapter
		id="splunkOutboundChannelAdapter" auto-startup="true" order="1"
		channel="outputToSplunk" splunk-server-ref="splunkServer"
		ingest="stream">
	</int-splunk:outbound-channel-adapter>

tcp

	<int-splunk:outbound-channel-adapter
		id="splunkOutboundChannelAdapter" auto-startup="true" order="1"
		channel="outputToSplunk" splunk-server-ref="splunkServer"
		ingest="tcp" tcpPort="9999">
	</int-splunk:outbound-channel-adapter>

Development

To build:

./gradlew build

To generate Eclipse metadata (.classpath and .project files), do the following:

./gradlew eclipse