com.splunk

Class TcpInput

java.lang.Object

com.splunk.Resource

com.splunk.Entity

com.splunk.Input

com.splunk.TcpInput

All Implemented Interfaces:

Map<String,Object>

public class TcpInput
extends Input

The TcpInput class represents a raw TCP data input. This differs from a cooked TCP input in that this TCP input is in raw form, and is not processed (or "cooked").

Nested Class Summary

Nested classes/interfaces inherited from interface java.util.Map

Map.Entry<K,V>

Field Summary

Fields inherited from class com.splunk.Entity

content, toUpdate

Fields inherited from class com.splunk.Resource

actions, path, refreshArgs, service, title, updated

Method Summary

Modifier and Type	Method and Description
Socket	attach() Returns a socket attached to this raw TCP input.
void	attachWith(ReceiverBehavior behavior) Submits events to this raw TCP input, reusing the connection.
TcpConnections	connections() Returns an object that contains the inbound raw TCP connections.
String	getConnectionHost() Returns the style of host connection.
String	getGroup() Returns the group of this raw TCP input.
String	getHost() Returns the source host of this raw TCP input where this indexer gets its data.
String	getIndex() Returns the index name of this raw TCP input.
InputKind	getKind() Returns the input kind of this input.
int	getPort() Returns the port that this input is listening on.
String	getQueue() Returns the queue for this raw TCP input.
int	getRcvBuf() Deprecated. Returns the value of the _rcvbuf attribute for this TCP input.
String	getRestrictToHost() Returns the incoming host restriction for this raw TCP input.
String	getSource() Returns the initial source key for this raw TCP input.
String	getSourceType() Returns the source type for events from this raw TCP input.
boolean	getSSL() Indicates whether this raw TCP input is using secure socket layer (SSL).
void	setConnectionHost(String connection_host) Sets the value for the from-host field for the remote server that is sending data.
void	setDisabled(boolean disabled) Sets whether this input is enabled or disabled.
void	setHost(String host) Sets the host from which the indexer gets data.
void	setIndex(String index) Sets the index in which to store all generated events.
void	setQueue(String queue) Sets how the input processor should deposit the events it reads.
void	setRawTcpDoneTimeout(int rawTcpDoneTimeout) Sets the timeout value for adding a Done key.
void	setSource(String source) Sets the initial value for the source key for events from this input.
void	setSourceType(String sourcetype) Sets the source type for events from this raw TCP input.
void	setSSL(boolean SSL) Sets whether to use secure socket layer (SSL).
void	submit(String eventBody) Submit a single event to this raw TCP input by opening the connection, submitting the event, and closing the connection.
void	update(Map<String,Object> args) Updates the entity with the values you previously set using the setter methods, and any additional specified arguments.

Methods inherited from class com.splunk.Entity

actionPath, clear, containsKey, containsValue, disable, enable, entrySet, get, getContent, getMetadata, isDisabled, isEmpty, isNameChangeAllowed, keySet, put, putAll, refresh, remove, remove, size, update, validate, values

Methods inherited from class com.splunk.Resource

getName, getPath, getService, getTitle, getUpdated, invalidate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.util.Map

compute, computeIfAbsent, computeIfPresent, equals, forEach, getOrDefault, hashCode, merge, putIfAbsent, remove, replace, replace, replaceAll

Method Detail

attach

public Socket attach()
              throws IOException

Returns a socket attached to this raw TCP input.

Returns:

Socket instance

Throws:

IOException - The IOException instance

attachWith

public void attachWith(ReceiverBehavior behavior)
                throws IOException

Submits events to this raw TCP input, reusing the connection. This method passes an output stream connected to the index to the run method of the ReceiverBehavior object, then handles setting up and tearing down the socket. For an example of how to use this method, see How to get data into Splunk on dev.splunk.com.

Parameters:

behavior - The ReceiverBehavior instance

Throws:

IOException - The IOException instance

connections

public TcpConnections connections()

Returns an object that contains the inbound raw TCP connections.

Returns:

The TCP connections object.

getConnectionHost

public String getConnectionHost()

Returns the style of host connection. Valid values are: "ip", "dns", and "none".

Returns:

The style of host connection, or null if not specified.

getGroup

public String getGroup()

Returns the group of this raw TCP input.

Returns:

The group.

getHost

public String getHost()

Returns the source host of this raw TCP input where this indexer gets its data.

Returns:

The source host, or null if not specified.

getIndex

public String getIndex()

Returns the index name of this raw TCP input.

Returns:

The index name, or null if not specified.

getKind

public InputKind getKind()

Returns the input kind of this input.

Overrides:

getKind in class Input

Returns:

The input kind.

getQueue

public String getQueue()

Returns the queue for this raw TCP input. Valid values are: "parsingQueue" and "indexQueue".

Returns:

The queue, or null if not specified.

getRcvBuf

public int getRcvBuf()

Deprecated. Returns the value of the _rcvbuf attribute for this TCP input.

Returns:

The _rcvbuf value.

getRestrictToHost

public String getRestrictToHost()

Returns the incoming host restriction for this raw TCP input. When specified, this input only accepts data from the specified host.

Returns:

The incoming host restriction, or null if not specified.

getSource

public String getSource()

Returns the initial source key for this raw TCP input. Typically this value is the input file path.

Returns:

The source key, or null if not specified.

getSourceType

public String getSourceType()

Returns the source type for events from this raw TCP input.

Returns:

The source type, or null if not specified.

getSSL

public boolean getSSL()

Indicates whether this raw TCP input is using secure socket layer (SSL).

Returns:

true if this input is using SSL, false if not.

setSSL

public void setSSL(boolean SSL)

Sets whether to use secure socket layer (SSL).

Parameters:

SSL - true to use SSL, false if not.

setConnectionHost

public void setConnectionHost(String connection_host)

Sets the value for the from-host field for the remote server that is sending data. Valid values are:

• "ip": Sets the host to the IP address of the remote server sending data.
• "dns": Sets the host to the reverse DNS entry for the IP address of the remote server sending data.
• "none": Leaves the host as specified in inputs.conf, which is typically the Splunk system host name.

Parameters:

connection_host - The connection host information.

setDisabled

public void setDisabled(boolean disabled)

Sets whether this input is enabled or disabled.

Note: Using this method requires you to restart Splunk before this setting takes effect. To avoid restarting Splunk, use the Entity.disable and Entity.enable methods instead, which take effect immediately.

Parameters:

disabled - true to disable this input, false to enable it.

setHost

public void setHost(String host)

Sets the host from which the indexer gets data.

Parameters:

host - The host name.

setIndex

public void setIndex(String index)

Sets the index in which to store all generated events.

Parameters:

index - The index name.

submit

public void submit(String eventBody)
            throws IOException

Submit a single event to this raw TCP input by opening the connection, submitting the event, and closing the connection. To submit multiple events, use attachWith to open a single connection.

Parameters:

eventBody - A string that contains the event.

Throws:

IOException - The IOException instance

See Also:

attachWith(com.splunk.ReceiverBehavior)

setQueue

public void setQueue(String queue)

Sets how the input processor should deposit the events it reads. Valid values are:

• "parsingQueue": Applies props.conf and other parsing rules to your data.
• "indexQueue": Sends your data directly into the index.

Parameters:

queue - The queue-processing type.

setRawTcpDoneTimeout

public void setRawTcpDoneTimeout(int rawTcpDoneTimeout)

Sets the timeout value for adding a Done key. If a connection over the input port specified by name remains idle after receiving data for this specified number of seconds, it adds a Done key, implying that the last event has been completely received.

Parameters:

rawTcpDoneTimeout - The timeout value, in seconds.

setSource

public void setSource(String source)

Sets the initial value for the source key for events from this input. The source key is used during parsing and indexing. The source field is used for searches. As a convenience, the source string is prepended with "source::".

Note: Overriding the source key is generally not recommended. Typically, the input layer provides a more accurate string to aid in problem analysis and investigation, accurately recording the file from which the data was retrieved. Consider the use of source types, tagging, and search wildcards before overriding this value.

Parameters:

source - The source.

setSourceType

public void setSourceType(String sourcetype)

Sets the source type for events from this raw TCP input.

Parameters:

sourcetype - The source type.

getPort

public int getPort()

Returns the port that this input is listening on.

Returns:

int value

update

public void update(Map<String,Object> args)

Updates the entity with the values you previously set using the setter methods, and any additional specified arguments. The specified arguments take precedent over the values that were set using the setter methods. Overrides the update method to additionally update this input's path if the RestrictToHost property is changed.

Overrides:

update in class Entity

Parameters:

args - The arguments to update.