Versions Compared
Key
- This line was added.
- This line was removed.
- Formatting was changed.
Introduction
The Splunk pluginsIntroduction
Splunk Enterprise is a fully featured, powerful platform for collecting, searching, monitoring and analyzing machine data. Splunk Enterprise is easy to deploy and use. It turns machine data into rapid visibility, insight and intelligence.
Use case(s)
User Storie(s)
- As a pipeline developer, I would like to write relevant and filtered machine level data to Splunk for log analysis
- As a pipeline developer, I would like to sent The destination sends HTTP POST requests to the HEC endpoint using the JSON data format. The destination generates one HTTP request for each batch, sending multiple records at a timefilter and transform relevant fields to send to Splunk for analysis
- As a pipeline developer I would like to ensure the records and relevant metadata are transformed into the correct format needed by Splunk HTTP Event Collector (Splunk HEC). Each record must contain the event data and optionally the event optional metadata in the format required by Splunk.required format.
- As a pipeline developer, I would like to send HTTP POST requests to Spunk HEC in JSON. One HTTP Request is generated for one batch of records to Splunk HEC
- As a pipeline developer, I would like to get an error if the data is not written successfully to Spunk HTTP Event Collector (Splunk HEC)
Plugin Type
- Batch Source
- Batch Sink
- Real-time Source
- Real-time Sink
- Action
- Post-Run Action
- Aggregate
- Join
- Spark Model
- Spark Compute
Configurables
This integration should be built using two plugins:
Zendesk single object
Used when you want to pull only a single object from Zendesk
Zendesk multi-object
Used when you want to pull only a single object from Zendesk
The plugin should output one record per row in Zendesk, with an additional field specifying the object where the record came from. Refer to the Salesforce multi-objects plugin for examplesFollowing fields must be configurable for the plugin:
| API Endpoint | Splunk API Endpoint | Example |
| HEC Token | HEC Token | |
| HTTP Compression | Compression format for the messages:
| |
| Connect Timeout | The time in milliseconds to wait for a connection. Set to 0 for infinite. Defaults to 60000 (1 minute). | |
| Read Timeout | The time in milliseconds to wait for a connection. Set to 0 for infinite. Defaults to 60000 (1 minute). | |
| Authentication Type | Determines the authentication type used to connect to the server:
| |
| Use Proxy | Enables using an HTTP proxy to connect to the system. |
Design / Implementation Tips
- Tip #1
- Tip #2
Design
Approach(s)
Properties
Security
Limitation(s)
Future Work
- Some future work – HYDRATOR-99999
- Another future work – HYDRATOR-99999
Test Case(s)
- Test case #1
- Test case #2
Sample Pipeline
Please attach one or more sample pipeline(s) and associated data.
Pipeline #1
Pipeline #2
Table of Contents
Table of Contents style circle
Checklist
- User stories documented
- User stories reviewed
- Design documented
- Design reviewed
- Feature merged
- Examples and guides
- Integration tests
- Documentation for feature
- Short video demonstrating the feature