For the complete documentation index, see llms.txt. This page is also available as Markdown.

Events to Splunk

Purpose

Sends event data directly from the device to Splunk, in addition to or instead of the default BFE/EMS backend.

Location

data/source/SupportAppRepository.kt (send logic), data/source/splunk/ (SplunkRemoteSource/SplunkApi), data/models/splunk/SplunkEventReporting.kt, common/SupportAgentConfig.kt (Splunk config fields).

Behavior

SupportAppRepository.sendEvent():

  1. If cradleSyncModeEnabled=true, the event is buffered locally instead of sent (see Cradle Sync<link this to cradle sync>); Splunk forwarding does not apply in this mode.

  2. Otherwise the event is POSTed to the configured EMS backend (config.eventUrl).

  3. If that succeeds and config.useSplunk=true, the event is also POSTed to Splunk's HTTP Event Collector (splunkUrl or, if unset, falling back to eventUrl), with header Authorization: Splunk .

  4. If the initial send fails, the event is queued locally for retry (EventReportingBackupEntry) regardless of the Splunk setting.

User Guide

  1. Enable cradleSyncModeEnabled

Configuration

Configuration
Type
Default
Description

useSplunk

Boolean

false

Enables sending events to Splunk in addition to the EMS backend

splunkUrl

String

-

Host/port of the Splunk HTTP Event Collector

splunkAuthToken

String

-

Auth token defined in the Splunk Event Collector

splunkSource

String

-

Optional Splunk source field override

splunkSourceType

String

-

Optional Splunk sourcetype field override

splunkApiPath

String

-

API path appended to splunkUrl, e.g. services/collector/raw

ignoreSSLCerts

Boolean

false

Ignore SSL certificate issues during Splunk event posting

Error Handling

Scenario
Expected behavior
Recovery

splunkUrl/splunkAuthToken missing while useSplunk=true

Splunk POST fails/is skipped (event still delivered to EMS backend if that succeeded)

Fix configuration; no automatic retry specific to Splunk

Splunk endpoint unreachable

Logged failure; does not affect the primary EMS backend delivery, which happens first

N/A — Splunk forwarding is fire-and-forget after primary success

SSL certificate error

Request fails unless ignoreSSLCerts=true

Set ignoreSSLCerts or fix the certificate

Logging and Troubleshooting

Problem: Events are not appearing in Splunk.

Check:

  1. Is useSplunk set to true in the effective configuration (visible in Advanced Tools → Config Viewer)?

  2. Are splunkUrl, splunkAuthToken, and splunkApiPath all populated?

  3. Is the primary EMS backend send succeeding? (Splunk forwarding only happens after a successful primary send — see step 3 above.)

  4. Check SupportAppRepository logs for the Splunk POST response code.

Last updated