NullPointerException in camel-splunk when consuming via a saved search.

Solution Verified - Updated -

Environment

  • JBoss Fuse 6.2.0 (embedded apache-camel-2.15.1.redhat-620133.zip)
  • Camel 2.15.2

Issue

apache-camel-2.15.1.redhat-620133/examples contains a camel-splunk demo.
The demo consists of three different clients, out of which the "Saved search query on Splunk" does not work.
Following the README.txt of the demo it should be run as follows

Command:
 mvn compile exec:java -Psaved-search-client

However it raises this NullPointerException

Error:
2015-08-05 10:05:56,205 [k://savedsearch] WARN  SplunkConsumer - Caused by: [java.lang.NullPointerException - null]
java.lang.NullPointerException
    at org.apache.camel.component.splunk.support.SplunkDataReader.savedSearch(SplunkDataReader.java:224)
    at org.apache.camel.component.splunk.support.SplunkDataReader.read(SplunkDataReader.java:101)
    at org.apache.camel.component.splunk.support.SplunkDataReader.read(SplunkDataReader.java:89)
    at org.apache.camel.component.splunk.SplunkConsumer.poll(SplunkConsumer.java:91)
    at org.apache.camel.impl.ScheduledPollConsumer.doRun(ScheduledPollConsumer.java:174)
    at org.apache.camel.impl.ScheduledPollConsumer.run(ScheduledPollConsumer.java:101)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
    at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)

Resolution

For this part of the camel-splunk demo to work, you need to create a saved search in Splunk and reference the name in src/main/java/org/apache/camel/example/splunk/SplunkSavedSearchRouteBuilder.java of the camel-splunk demo (here referencing a saved search named MySavedSearch):

from("splunk://savedsearch?host={{splunk.host}}&port={{splunk.port}}&delay=10s"
  + "&username={{splunk.username}}&password={{splunk.password}}&initEarliestTime=08/17/13 08:35:46:456"
  + "&savedSearch=MySavedSearch" )
  .log("${body}");

Root Cause

The camel-splunk demo uses a saved search that does not exist when following the Splunk tutorial. The tutorial does not create a saved search but it contains information on how to create you own saved search in Splunk.

The NullPointerException is fixed in later versions of Camel.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments