Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Splunk sources and sinks #954

Merged
merged 1 commit into from
Jul 1, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/modules/ROOT/nav.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,9 @@
* xref:slack-source.adoc[]
* xref:solr-sink.adoc[]
* xref:solr-source.adoc[]
* xref:splunk-hec-sink.adoc[]
* xref:splunk-sink.adoc[]
* xref:splunk-source.adoc[]
* xref:sqlserver-sink.adoc[]
* xref:sqlserver-source.adoc[]
* xref:ssh-sink.adoc[]
Expand Down
123 changes: 123 additions & 0 deletions kamelets/splunk-hec-sink.kamelet.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,123 @@
# ---------------------------------------------------------------------------
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ---------------------------------------------------------------------------
apiVersion: camel.apache.org/v1alpha1
kind: Kamelet
metadata:
name: splunk-hec-sink
annotations:
camel.apache.org/kamelet.support.level: "Preview"
camel.apache.org/catalog.version: "main-SNAPSHOT"
camel.apache.org/kamelet.icon: "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjRweCIgaGVpZ2h0PSIyNHB4IiB2aWV3Qm94PSIwIDAgMjQgMjQiIHJvbGU9ImltZyIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48dGl0bGU+U3BsdW5rIGljb248L3RpdGxlPjxwYXRoIGQ9Ik0yMy4zNDggMTEuOTExbC0yLjI0MS0xLjA5MXYtLjY1TDI0IDExLjYyMXYuNTkzbC0yLjg5MyAxLjQzOHYtLjYzNnptLTUuMzk3IDEuODQxaC0uOTYxdi01LjMxaC45NjF2My4xMTZoLjEwMmwxLjI4LTEuNDgxLjcyMy4zMS0xLjIzIDEuMzE2IDEuNDUzIDEuODA5LS44ODguMzExLTEuNDQtMS45OTZ6bS0yLjU3Ny0uMDAydi0yLjA2OGEyLjY4NSAyLjY4NSAwIDAgMC0uMDI2LS40Mi43OTEuNzkxIDAgMCAwLS4wOS0uMjZjLS4xMTMtLjIwMi0uMzA4LS4zMDQtLjU5LS4zMDRhLjg4OC44ODggMCAwIDAtLjQ2MS4xMTMuNjczLjY3MyAwIDAgMC0uMjg2LjMzIDEuMDEyIDEuMDEyIDAgMCAwLS4wNy4yNjNjLS4wMTIuMTMtLjAxOS4yNjItLjAxNy4zOTV2MS45NWgtLjk2MXYtMy42MTRoLjk2MWwuMDAyLjQ4NWMuMTg1LS4yLjM3My0uMzQ4LjU2Ni0uNDM3LjE5Mi0uMDg5LjQxOC0uMTM0LjY3My0uMTM0LjI4NiAwIC41MjcuMDU4LjcyMS4xNzdhMS4wMTYgMS4wMTYgMCAwIDEgLjQ3NS42NjUgMS45NzIgMS45NzIgMCAwIDEgLjA1NC40NDhjLjAwMi4xLjAwNC4yMi4wMDQuMzU4djIuMDUzem0tNC4xMTUuMDAybC0uMDAyLS40ODVhMS43ODMgMS43ODMgMCAwIDEtLjU2NS40MzcgMS41OTcgMS41OTcgMCAwIDEtLjY3NC4xMzVjLS4yODUgMC0uNTI0LS4wNTctLjcyLS4xN2EuOTcyLjk3MiAwIDAgMS0uNDI1LS41MDQuNzUuNzUgMCAwIDEtLjA1NC0uMTY3IDEuOTE4IDEuOTE4IDAgMCAxLS4wMzMtLjE5OSAyLjAzMyAyLjAzMyAwIDAgMS0uMDE3LS4yNTggMTUuNTE2IDE1LjUxNiAwIDAgMS0uMDA1LS4zNTVWMTAuMTNoLjk1NnYyLjA3Yy0uMDAzLjE0MS4wMDYuMjgyLjAyNi40Mi4wMTUuMDkyLjA0NS4xOC4wOS4yNi4xMTMuMjA0LjMwOC4zMDYuNTkuMzA2LjM2IDAgLjYwNi0uMTUuNzQtLjQ0OS4wMzUtLjA4Mi4wNi0uMTY4LjA3NC0uMjU3LjAxNy0uMTM0LjAyNC0uMjY5LjAyMi0uNDAzdi0xLjk1aC45NTV2My42MjR6TTcuMTg0IDguNDRoLjk1NXY1LjMxaC0uOTU1ek01Ljc1OSAxMS45YzAtLjM5Ni0uMDgtLjcwOC0uMjQtLjkzN2EuNzU5Ljc1OSAwIDAgMC0uNjU3LS4zNDUuODA0LjgwNCAwIDAgMC0uNjkzLjM2NmMtLjE3MS4yNDUtLjI1Ni41NzQtLjI1My45OSAwIC40MDUuMDg0LjcyMy4yNS45NTdhLjc5Ni43OTYgMCAwIDAgLjY5LjM0Ny42ODUuNjg1IDAgMCAwIC40MzMtLjEzNS45ODUuOTg1IDAgMCAwIC4yNzctLjM0Yy4wNzEtLjE0LjEyMS0uMjkyLjE0Ny0uNDQ4LjAzLS4xNTEuMDQzLS4zLjA0Ni0uNDU1bTEuMDEtLjAzNmMuMDAzLjI2Ni0uMDQuNTMyLS4xMjkuNzg2LS4wODIuMjMtLjIwNC40NDEtLjM2NC42MjYtLjMxLjM2MS0uNzY0LjU2Ny0xLjI0LjU2M2ExLjY3IDEuNjcgMCAwIDEtLjMxMy0uMDI4IDEuMDQxIDEuMDQxIDAgMCAxLS4yNzUtLjA5OCAxLjMzIDEuMzMgMCAwIDEtLjI1Ny0uMTc4IDIuMzc5IDIuMzc5IDAgMCAxLS4yNjUtLjI2OHYyLjI5M2gtLjkyOXYtNS40MjVoLjkzbC4wMDQuNTI5Yy4xNjktLjIxMi4zNTMtLjM2OC41NS0uNDY4LjE5Ny0uMS40MjYtLjE1LjY4OC0uMTQ3YTEuNTA5IDEuNTA5IDAgMCAxIDEuMTU2LjUwN2MuMTQ4LjE2Ni4yNTkuMzYxLjMzLjU3MS4wOC4yMzYuMTIuNDg1LjExNS43MzdtLTQuMjEuODlhLjk0Ni45NDYgMCAwIDEtLjEwMi40NDEgMS4wMDcgMS4wMDcgMCAwIDEtLjI4Mi4zNDVjLS4xMy4xLS4yNzUuMTczLS40My4yMmExLjggMS44IDAgMCAxLS41NDYuMDggMS45ODUgMS45ODUgMCAwIDEtLjYzNy0uMDk3IDEuOTY0IDEuOTY0IDAgMCAxLS41NjMtLjMybC4zMTItLjUwNWMuMTUuMTI2LjI4NC4yMTcuNDA1LjI3NS4xMTUuMDU3LjI0LjA4Ny4zNjguMDg3YS41NTcuNTU3IDAgMCAwIC4zNzMtLjEyLjM5Ni4zOTYgMCAwIDAgLjE0LS4zMjIuNDc1LjQ3NSAwIDAgMC0uMTItLjMxOCAxLjMwNiAxLjMwNiAwIDAgMC0uMTg3LS4xNzMgOS4yMzEgOS4yMzEgMCAwIDAtLjMwOC0uMjMyIDYuNzg3IDYuNzg3IDAgMCAxLS4yODEtLjIxIDIuMTEgMi4xMSAwIDAgMS0uMjUyLS4yMzIgMS4wMzkgMS4wMzkgMCAwIDEtLjE4LS4yNzUuODI2LjgyNiAwIDAgMS0uMDY5LS4zNDcuODkzLjg5MyAwIDAgMSAuMDk0LS40MDkuOTM1LjkzNSAwIDAgMSAuMjU1LS4zMTQgMS4yMiAxLjIyIDAgMCAxIC4zOS0uMjAzYy4xNi0uMDUuMzI3LS4wNzQuNDk0LS4wNzIuMTg0IDAgLjM2OC4wMjYuNTQ1LjA3Ni4xNzQuMDUuMzM4LjEyMy40ODguMjE5bC0uMjgyLjQ1NGExLjA1IDEuMDUgMCAwIDAtLjYwOC0uMjAxLjUwNC41MDQgMCAwIDAtLjMyMy4xMDIuMzA3LjMwNyAwIDAgMC0uMTI2LjI1M2MwIC4wOTguMDQxLjE5My4xMTMuMjYuMDc0LjA3OC4yMDMuMTg2LjM4NS4zMjUuMTg1LjEzNi4zMzYuMjUzLjQ1Ny4zNTUuMTA0LjA4NS4yMDIuMTgyLjI4Ni4yODYuMDY1LjA4LjExNS4xNzMuMTQ1LjI3M2EuODA4LjgwOCAwIDAgMSAuMDQ2LjI5OVoiLz48L3N2Zz4="
camel.apache.org/provider: "Apache Software Foundation"
camel.apache.org/kamelet.group: "SPLUNK"
labels:
camel.apache.org/kamelet.type: "sink"
spec:
definition:
title: "Splunk HEC Sink"
description: |-
The Splunk HEC sink allows to send data to Splunk using the https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector[HTTP Event Collector].

required:
- splunkUrl
- token
type: object
properties:
splunkUrl:
title: Splunk URL
description: The URL of your Splunk server. No need to set the protocol prefix.
type: string
example: my_server.splunkcloud.com:8088
token:
title: Token
description: The Token of the HEC. Note it is not the user's authentication token.
type: string
format: password
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:password
- urn:camel:group:credentials
hostPayload:
title: Host of the Event
description: The host field set in the data sent to Splunk, it is not related to the Splunk URL or the connection to Splunk server.
type: string
bodyOnly:
title: Body Only
description: Send to Splunk only data contained in the body.
type: boolean
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:checkbox
default: false
headersOnly:
title: Headers Only
description: Send to Splunk only data contained in the headers.
type: boolean
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:checkbox
default: false
index:
title: Index
description: Splunk index to write to.
type: string
source:
title: Source
description: The source named field of the data.
type: string
sourceType:
title: Source Type
description: The source named field of the data.
type: string
skipTlsVerify:
title: Skip TLS Verification
description: Skip TLS verification.
type: boolean
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:checkbox
default: false
https:
title: Secure
description: Use a secure HTTPS connection.
type: boolean
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:checkbox
default: true
time:
title: Time
description: Time this even occurred. By default, the time will be when this event hits the splunk server.
type: string
types:
in:
mediaType: application/json
dependencies:
- "camel:core"
- "camel:splunk-hec"
- "camel:kamelet"
template:
from:
uri: "kamelet:source"
steps:
- to:
uri: "splunk-hec:{{splunkUrl}}/{{token}}"
parameters:
host: "{{?hostPayload}}"
bodyOnly: "{{?bodyOnly}}"
headersOnly: "{{?headersOnly}}"
index: "{{?index}}"
source: "{{?source}}"
sourceType: "{{?sourceType}}"
skipTlsVerify: "{{?skipTlsVerify}}"
https: "{{?https}}"
time: "{{?time}}"
122 changes: 122 additions & 0 deletions kamelets/splunk-sink.kamelet.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,122 @@
# ---------------------------------------------------------------------------
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ---------------------------------------------------------------------------
apiVersion: camel.apache.org/v1alpha1
kind: Kamelet
metadata:
name: splunk-sink
annotations:
camel.apache.org/kamelet.support.level: "Preview"
camel.apache.org/catalog.version: "main-SNAPSHOT"
camel.apache.org/kamelet.icon: "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjRweCIgaGVpZ2h0PSIyNHB4IiB2aWV3Qm94PSIwIDAgMjQgMjQiIHJvbGU9ImltZyIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48dGl0bGU+U3BsdW5rIGljb248L3RpdGxlPjxwYXRoIGQ9Ik0yMy4zNDggMTEuOTExbC0yLjI0MS0xLjA5MXYtLjY1TDI0IDExLjYyMXYuNTkzbC0yLjg5MyAxLjQzOHYtLjYzNnptLTUuMzk3IDEuODQxaC0uOTYxdi01LjMxaC45NjF2My4xMTZoLjEwMmwxLjI4LTEuNDgxLjcyMy4zMS0xLjIzIDEuMzE2IDEuNDUzIDEuODA5LS44ODguMzExLTEuNDQtMS45OTZ6bS0yLjU3Ny0uMDAydi0yLjA2OGEyLjY4NSAyLjY4NSAwIDAgMC0uMDI2LS40Mi43OTEuNzkxIDAgMCAwLS4wOS0uMjZjLS4xMTMtLjIwMi0uMzA4LS4zMDQtLjU5LS4zMDRhLjg4OC44ODggMCAwIDAtLjQ2MS4xMTMuNjczLjY3MyAwIDAgMC0uMjg2LjMzIDEuMDEyIDEuMDEyIDAgMCAwLS4wNy4yNjNjLS4wMTIuMTMtLjAxOS4yNjItLjAxNy4zOTV2MS45NWgtLjk2MXYtMy42MTRoLjk2MWwuMDAyLjQ4NWMuMTg1LS4yLjM3My0uMzQ4LjU2Ni0uNDM3LjE5Mi0uMDg5LjQxOC0uMTM0LjY3My0uMTM0LjI4NiAwIC41MjcuMDU4LjcyMS4xNzdhMS4wMTYgMS4wMTYgMCAwIDEgLjQ3NS42NjUgMS45NzIgMS45NzIgMCAwIDEgLjA1NC40NDhjLjAwMi4xLjAwNC4yMi4wMDQuMzU4djIuMDUzem0tNC4xMTUuMDAybC0uMDAyLS40ODVhMS43ODMgMS43ODMgMCAwIDEtLjU2NS40MzcgMS41OTcgMS41OTcgMCAwIDEtLjY3NC4xMzVjLS4yODUgMC0uNTI0LS4wNTctLjcyLS4xN2EuOTcyLjk3MiAwIDAgMS0uNDI1LS41MDQuNzUuNzUgMCAwIDEtLjA1NC0uMTY3IDEuOTE4IDEuOTE4IDAgMCAxLS4wMzMtLjE5OSAyLjAzMyAyLjAzMyAwIDAgMS0uMDE3LS4yNTggMTUuNTE2IDE1LjUxNiAwIDAgMS0uMDA1LS4zNTVWMTAuMTNoLjk1NnYyLjA3Yy0uMDAzLjE0MS4wMDYuMjgyLjAyNi40Mi4wMTUuMDkyLjA0NS4xOC4wOS4yNi4xMTMuMjA0LjMwOC4zMDYuNTkuMzA2LjM2IDAgLjYwNi0uMTUuNzQtLjQ0OS4wMzUtLjA4Mi4wNi0uMTY4LjA3NC0uMjU3LjAxNy0uMTM0LjAyNC0uMjY5LjAyMi0uNDAzdi0xLjk1aC45NTV2My42MjR6TTcuMTg0IDguNDRoLjk1NXY1LjMxaC0uOTU1ek01Ljc1OSAxMS45YzAtLjM5Ni0uMDgtLjcwOC0uMjQtLjkzN2EuNzU5Ljc1OSAwIDAgMC0uNjU3LS4zNDUuODA0LjgwNCAwIDAgMC0uNjkzLjM2NmMtLjE3MS4yNDUtLjI1Ni41NzQtLjI1My45OSAwIC40MDUuMDg0LjcyMy4yNS45NTdhLjc5Ni43OTYgMCAwIDAgLjY5LjM0Ny42ODUuNjg1IDAgMCAwIC40MzMtLjEzNS45ODUuOTg1IDAgMCAwIC4yNzctLjM0Yy4wNzEtLjE0LjEyMS0uMjkyLjE0Ny0uNDQ4LjAzLS4xNTEuMDQzLS4zLjA0Ni0uNDU1bTEuMDEtLjAzNmMuMDAzLjI2Ni0uMDQuNTMyLS4xMjkuNzg2LS4wODIuMjMtLjIwNC40NDEtLjM2NC42MjYtLjMxLjM2MS0uNzY0LjU2Ny0xLjI0LjU2M2ExLjY3IDEuNjcgMCAwIDEtLjMxMy0uMDI4IDEuMDQxIDEuMDQxIDAgMCAxLS4yNzUtLjA5OCAxLjMzIDEuMzMgMCAwIDEtLjI1Ny0uMTc4IDIuMzc5IDIuMzc5IDAgMCAxLS4yNjUtLjI2OHYyLjI5M2gtLjkyOXYtNS40MjVoLjkzbC4wMDQuNTI5Yy4xNjktLjIxMi4zNTMtLjM2OC41NS0uNDY4LjE5Ny0uMS40MjYtLjE1LjY4OC0uMTQ3YTEuNTA5IDEuNTA5IDAgMCAxIDEuMTU2LjUwN2MuMTQ4LjE2Ni4yNTkuMzYxLjMzLjU3MS4wOC4yMzYuMTIuNDg1LjExNS43MzdtLTQuMjEuODlhLjk0Ni45NDYgMCAwIDEtLjEwMi40NDEgMS4wMDcgMS4wMDcgMCAwIDEtLjI4Mi4zNDVjLS4xMy4xLS4yNzUuMTczLS40My4yMmExLjggMS44IDAgMCAxLS41NDYuMDggMS45ODUgMS45ODUgMCAwIDEtLjYzNy0uMDk3IDEuOTY0IDEuOTY0IDAgMCAxLS41NjMtLjMybC4zMTItLjUwNWMuMTUuMTI2LjI4NC4yMTcuNDA1LjI3NS4xMTUuMDU3LjI0LjA4Ny4zNjguMDg3YS41NTcuNTU3IDAgMCAwIC4zNzMtLjEyLjM5Ni4zOTYgMCAwIDAgLjE0LS4zMjIuNDc1LjQ3NSAwIDAgMC0uMTItLjMxOCAxLjMwNiAxLjMwNiAwIDAgMC0uMTg3LS4xNzMgOS4yMzEgOS4yMzEgMCAwIDAtLjMwOC0uMjMyIDYuNzg3IDYuNzg3IDAgMCAxLS4yODEtLjIxIDIuMTEgMi4xMSAwIDAgMS0uMjUyLS4yMzIgMS4wMzkgMS4wMzkgMCAwIDEtLjE4LS4yNzUuODI2LjgyNiAwIDAgMS0uMDY5LS4zNDcuODkzLjg5MyAwIDAgMSAuMDk0LS40MDkuOTM1LjkzNSAwIDAgMSAuMjU1LS4zMTQgMS4yMiAxLjIyIDAgMCAxIC4zOS0uMjAzYy4xNi0uMDUuMzI3LS4wNzQuNDk0LS4wNzIuMTg0IDAgLjM2OC4wMjYuNTQ1LjA3Ni4xNzQuMDUuMzM4LjEyMy40ODguMjE5bC0uMjgyLjQ1NGExLjA1IDEuMDUgMCAwIDAtLjYwOC0uMjAxLjUwNC41MDQgMCAwIDAtLjMyMy4xMDIuMzA3LjMwNyAwIDAgMC0uMTI2LjI1M2MwIC4wOTguMDQxLjE5My4xMTMuMjYuMDc0LjA3OC4yMDMuMTg2LjM4NS4zMjUuMTg1LjEzNi4zMzYuMjUzLjQ1Ny4zNTUuMTA0LjA4NS4yMDIuMTgyLjI4Ni4yODYuMDY1LjA4LjExNS4xNzMuMTQ1LjI3M2EuODA4LjgwOCAwIDAgMSAuMDQ2LjI5OVoiLz48L3N2Zz4="
camel.apache.org/provider: "Apache Software Foundation"
camel.apache.org/kamelet.group: "SPLUNK"
labels:
camel.apache.org/kamelet.type: "sink"
spec:
definition:
title: "Splunk Sink"
description: |-
Send data to Splunk either by using "submit" or "stream" mode.

The payload MUST be in json format.

required:
- serverHostname
- username
- password
type: object
properties:
serverHostname:
title: Splunk Server Address
description: The address of your Splunk server.
type: string
example: my_server_splunk.com
serverPort:
title: Splunk Server Port
description: The address of your Splunk server.
type: integer
default: 8089
username:
title: Username
description: The username to authenticate to Splunk Server.
type: string
password:
title: Password
description: The password to authenticate to Splunk Server.
type: string
format: password
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:password
- urn:camel:group:credentials
index:
title: Index
description: Splunk index to write to.
type: string
protocol:
title: Protocol
description: Connection Protocol to Splunk server.
type: string
default: https
enum: ["http", "https"]
source:
title: Source
description: The source named field of the data.
type: string
sourceType:
title: Source Type
description: The source named field of the data.
type: string
app:
title: Splunk App
description: The app name in Splunk.
type: string
connectionTimeout:
title: Connection Timeout
description: Timeout in milliseconds when connecting to Splunk server
type: integer
default: 5000
mode:
title: Mode
description: The mode to publish events to Splunk.
type: string
default: stream
enum: ["submit", "stream"]
types:
in:
mediaType: application/json
dependencies:
- "camel:core"
- "camel:splunk"
- "camel:kamelet"
template:
from:
uri: "kamelet:source"
steps:
- to:
uri: "splunk:{{mode}}"
parameters:
host: "{{serverHostname}}"
port: "{{serverPort}}"
username: "{{username}}"
password: "{{password}}"
source: "{{?source}}"
sourceType: "{{?sourceType}}"
scheme: "{{?protocol}}"
index: "{{?index}}"
app: "{{?app}}"
connectionTimeout: "{{?connectionTimeout}}"
raw: true
Loading