Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 74. Splunk Source

Retrieve data from Splunk and outputs in json format.

For the fields accepting time specifiers like earliestTime, Splunk accepts a wide variety of formats, please check Splunk documentation for more information.

74.1. Configuration Options
Copy link

The following table summarizes the configuration options available for the splunk-source Kamelet:

Expand
PropertyNameDescriptionTypeDefaultExample

initEarliestTime *

Init Earliest Time

Initial start offset of the first search.

string

 

05/17/22 08:35:46:456

password *

Password

The password to authenticate to Splunk Server.

string

  

query *

Query

The Splunk query to run.

string

  

serverHostname *

Splunk Server Address

The address of your Splunk server.

string

 

my_server_splunk.com

username *

Username

The username to authenticate to Splunk Server.

string

  

app

Splunk App

The app name in Splunk.

string

  

connectionTimeout

Connection Timeout

Timeout in milliseconds when connecting to Splunk server

integer

  

count

Count

The maximum number of entities to return.

integer

  

delay

Delay

The number of milliseconds before the next poll.

integer

  

earliestTime

Earliest Time

Earliest time of the search time window.

string

 

05/17/22 08:35:46:456

index

Index

Splunk index to write to.

string

  

latestTime

Latest Time

Latest time of the search time window.

string

 

05/17/22 08:35:46:456

protocol

Protocol

Connection Protocol to Splunk server.

string

https

 

repeat

Repeat

The maximum number of fires.

integer

  

serverPort

Splunk Server Port

The address of your Splunk server.

integer

8089

 

source

Source

The source named field of the data.

string

  

sourceType

Source Type

The source named field of the data.

string

  

* = Fields marked with an asterisk are mandatory.

74.2. Dependencies
Copy link

74.2.1. Quarkus dependencies
Copy link

<dependencies>
  <dependency>
    <groupId>org.apache.camel.quarkus</groupId>
    <artifact>camel-quarkus-core</artifact>
  </dependency>
  <dependency>
    <groupId>org.apache.camel.quarkus</groupId>
    <artifact>camel-quarkus-jackson</artifact>
  </dependency>
  <dependency>
    <groupId>org.apache.camel.quarkus</groupId>
    <artifact>camel-quarkus-kamelet</artifact>
  </dependency>
  <dependency>
    <groupId>org.apache.camel.quarkus</groupId>
    <artifact>camel-quarkus-splunk</artifact>
  </dependency>
  <dependency>
    <groupId>com.fasterxml.jackson.datatype</groupId>
    <artifact>jackson-datatype-joda</artifact>
    <version>2.12.5</version>
  </dependency>
  <dependency>
    <groupId>org.apache.camel.kamelets</groupId>
    <artifact>camel-kamelets-utils</artifact>
    <version>4.8.5</version>
  </dependency>
</dependencies>
Copy to Clipboard Toggle word wrap

74.3. Usage
Copy link

74.3.1. Camel JBang usage
Copy link

74.3.1.1. Prerequisites for Jbang
Copy link

  • You must have installed JBang.
  • You must have executed the following command. 
jbang app install camel@apache/camel
Copy to Clipboard Toggle word wrap

For example, you have a file named route.yaml with this content. 

- route:
    from:
      uri: "kamelet:timer-source"
      parameters:
        period: 10000
        message: 'test'
      steps:
        - to:
            uri: "kamelet:log-sink"
Copy to Clipboard Toggle word wrap

You can now run it directly through the following command 

camel run route.yaml
Copy to Clipboard Toggle word wrap

74.3.2. Knative Source
Copy link

You must use the splunk-source Kamelet as a Knative source by binding it to a Knative object.

splunk-source-binding.yaml 

apiVersion: camel.apache.org/v1
kind: Pipe
metadata:
  name: splunk-source-binding
spec:
  source:
    ref:
      kind: Kamelet
      apiVersion: camel.apache.org/v1
      name: splunk-source
    properties:
      initEarliestTime: 05/17/22 08:35:46:456
      password: The Password
      query: The Query
      serverHostname: my_server_splunk.com
      username: The Username
  sink:
    ref:
      kind: Channel
      apiVersion: messaging.knative.dev/v1
      name: mychannel
Copy to Clipboard Toggle word wrap

74.3.3. Kafka Source
Copy link

You must use the splunk-source Kamelet as a Kafka source by binding it to a Kafka topic.

splunk-source-binding.yaml 

apiVersion: camel.apache.org/v1
kind: Pipe
metadata:
  name: splunk-source-binding
spec:
  source:
    ref:
      kind: Kamelet
      apiVersion: camel.apache.org/v1
      name: splunk-source
    properties:
      initEarliestTime: 05/17/22 08:35:46:456
      password: The Password
      query: The Query
      serverHostname: my_server_splunk.com
      username: The Username
  sink:
    ref:
      kind: KafkaTopic
      apiVersion: kafka.strimzi.io/v1beta1
      name: my-topic
Copy to Clipboard Toggle word wrap

74.4. Kamelets source file
Copy link

https://github.com/jboss-fuse/camel-kamelets/blob/camel-kamelets-4.10.3-branch/kamelets/splunk-source.kamelet.yaml

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top