Events to Splunk

Purpose

Sends event data directly from the device to Splunk, in addition to or instead of the default BFE/EMS backend.

Location

data/source/SupportAppRepository.kt (send logic), data/source/splunk/ (SplunkRemoteSource/SplunkApi), data/models/splunk/SplunkEventReporting.kt, common/SupportAgentConfig.kt (Splunk config fields).

Behavior

SupportAppRepository.sendEvent():

1. If cradleSyncModeEnabled=true, the event is buffered locally instead of sent (see Cradle Sync<link this to cradle sync>); Splunk forwarding does not apply in this mode.

2. Otherwise the event is POSTed to the configured EMS backend (config.eventUrl).

3. If that succeeds and config.useSplunk=true, the event is also POSTed to Splunk's HTTP Event Collector (splunkUrl or, if unset, falling back to eventUrl), with header Authorization: Splunk .

4. If the initial send fails, the event is queued locally for retry (EventReportingBackupEntry) regardless of the Splunk setting.

User Guide

1. Enable cradleSyncModeEnabled

Configuration

Configuration	Type	Default	Description
useSplunk	Boolean	false	Enables sending events to Splunk in addition to the EMS backend
splunkUrl	String	-	Host/port of the Splunk HTTP Event Collector
splunkAuthToken	String	-	Auth token defined in the Splunk Event Collector
splunkSource	String	-	Optional Splunk source field override
splunkSourceType	String	-	Optional Splunk sourcetype field override
splunkApiPath	String	-	API path appended to splunkUrl, e.g. services/collector/raw
ignoreSSLCerts	Boolean	false	Ignore SSL certificate issues during Splunk event posting

Error Handling

Scenario	Expected behavior	Recovery
splunkUrl/splunkAuthToken missing while useSplunk=true	Splunk POST fails/is skipped (event still delivered to EMS backend if that succeeded)	Fix configuration; no automatic retry specific to Splunk
Splunk endpoint unreachable	Logged failure; does not affect the primary EMS backend delivery, which happens first	N/A — Splunk forwarding is fire-and-forget after primary success
SSL certificate error	Request fails unless ignoreSSLCerts=true	Set ignoreSSLCerts or fix the certificate

Logging and Troubleshooting

Problem: Events are not appearing in Splunk.

Check:

1. Is useSplunk set to true in the effective configuration (visible in Advanced Tools → Config Viewer)?

2. Are splunkUrl, splunkAuthToken, and splunkApiPath all populated?

3. Is the primary EMS backend send succeeding? (Splunk forwarding only happens after a successful primary send — see step 3 above.)

4. Check SupportAppRepository logs for the Splunk POST response code.