splunk / splunk-javascript-logging Goto Github PK

I'm running the basic example with our the token and url values running, and I'm getting a timeout. This has happened both running locally, as well as running in an AWS Lambda.

Version of this project you're using: 0.10.1
Platform version: macOS 10.13.6 (Lambda Node.js 8.10)
Framework version: Node.js 8.11.2
Splunk version: 7.0.8.5

I'm able to connect successfully using curl, postman, and a node script using the request-promise library.

// Change to require("splunk-logging").Logger;
var SplunkLogger = require("splunk-logging").Logger;

/**

• Only the token property is required.
  */
  var config = {
  token: "EB96B256-153A-4492-BAEE-765DECC8320B",
  url: "https://localhost:8088"
  };

// Create a new logger
var Logger = new SplunkLogger(config);

Logger.error = function(err, context) {
// Handle errors here
console.log("error", err, "context", context);
};

Error: connect ECONNREFUSED 127.0.0.1:8088 when I send a payload.
Could you please help me.

The splunk-logging library depends on a deprecated package, request. Please see request/request#3142

Are there plans to move away from request?

Hi there!

Just found an issue using this package.

Lib: Splunk-logging v0.9.1
OS: MacOS 10.11.6
Node: 6.4.0
Splunk: 6.5.0

We're using a node script to send JSON data to splunk, and it's been working fine. Now I've stumbled upon an issue where the text includes parentheses inside a string.

For example, this:
id:329,build:(id:164979)
becomes:
id:329,build:%28id:164979%29
(as seen inside splunk)

I've isolated the issue to splunk-logging/splunklogger.js line 435, row 47.

The content-type is set to application/x-www-form-urlencoded, even though the default options for the request module include "json": true

I hope that line 435 can be removed entirely. It makes no sense to me -- both indirectly setting the content-type to json, and then explicitly setting it to x-www-form-urlencoded afterwards.

i wan to use with python.

When the library sends the events to the server, if the server responds with an error status code (eg: 403) and the body cannot be parsed as expected (say because an HTML response is given), then the logger silently ignores the error and the log is treated as if it is successful.

I would suggest that error response status code like this should be dealt with as an error. Perhaps the retry logic can be short-circuited, but the error callbacks should be invoked so that the issue is not silently swallowed and ignored.

Is it possible to use this plugin for Client-Side Javascript Application?

Hello,

I am trying to use the library to log data to Splunk from an ReactJS app on the front end. But when I try with basic example I am getting the errors given below.

Module not found: Error: Can't resolve 'crypto' in '#####/node_modules/needle/lib'
BREAKING CHANGE: webpack < 5 used to include polyfills for node.js core modules by default.
This is no longer the case. Verify if you need this module and configure a polyfill for it.

If you want to include a polyfill, you need to:
	- add a fallback 'resolve.fallback: { "crypto": require.resolve("crypto-browserify") }'
	- install 'crypto-browserify'
If you don't want to include a polyfill, you can use an empty module like this:
	resolve.fallback: { "crypto": false }
WARNING in ./node_modules/needle/lib/needle.js 44:13-28
Module not found: Error: Can't resolve 'zlib' in '#####/node_modules/needle/lib'

BREAKING CHANGE: webpack < 5 used to include polyfills for node.js core modules by default.
This is no longer the case. Verify if you need this module and configure a polyfill for it.

If you want to include a polyfill, you need to:
	- add a fallback 'resolve.fallback: { "zlib": require.resolve("browserify-zlib") }'
	- install 'browserify-zlib'
If you don't want to include a polyfill, you can use an empty module like this:
	resolve.fallback: { "zlib": false }

WARNING in ./node_modules/sax/lib/sax.js 162:13-37
Module not found: Error: Can't resolve 'stream' in '#####/node_modules/sax/lib'

BREAKING CHANGE: webpack < 5 used to include polyfills for node.js core modules by default.
This is no longer the case. Verify if you need this module and configure a polyfill for it.

If you want to include a polyfill, you need to:
	- add a fallback 'resolve.fallback: { "stream": require.resolve("stream-browserify") }'
	- install 'stream-browserify'
If you don't want to include a polyfill, you can use an empty module like this:
	resolve.fallback: { "stream": false }
...

Could you help us to resolve this issue?
Please suggest if there is any other way to integrate Splunk on the FE apps if it is not resolvable.

Information :
ReactJS - react: "^17.0.2", react-scripts : "5.0.1"
Version of this project you're using - 0.11.1
Platform version - MacOS
Framework version - Node.js v14.17.0

See splunk/splunk-bunyan-logger#5

We're using this to send events to our Splunk Cloud implementation from AWS Lambda. Our HTTP EC is set up to use port 443, but this port is not allowed by the logger config (which requires port numbers > 1000). I'm working around this by just commenting out this check in our installed copy, but this seems like a bug.

Do you plan to support the metrics format in this library? Specifically, I'm interested in the format used via a HEC over HTTP/S

Description:
{ Error: Server is busy at Request._callback (/usr/src/app/node_modules/splunk-logging/splunklogger.js:484:35) at Request.self.callback (/usr/src/app/node_modules/request/request.js:185:22) at Request.emit (events.js:182:13) at Request. (/usr/src/app/node_modules/request/request.js:1161:10) at Request.emit (events.js:182:13) at IncomingMessage. (/usr/src/app/node_modules/request/request.js:1083:12) at Object.onceWrapper (events.js:273:13) at IncomingMessage.emit (events.js:187:15) at endReadableNT (_stream_readable.js:1085:12) at process._tickCallback (internal/process/next_tick.js:63:19) code: 9 }

For companies that use this library, it is important to understand who is the copyright holder.
In the license file that is attached, the copyright holder is not clearly stated but it is still kept as the template value.

It would be great if you could add the name(s) of the copyright holder such that the legal situation gets clarified properly.

Using this configs:
maxRetries: 0, batchInterval: 5000, maxBatchSize: 1024, // kb maxBatchCount: 10
This lib is causing a huge memory leak, Node HTTPParser objects are kept for each HTTP request sent to splunk

I need to send ca certificate while sending request to splunk using splunk-logging.
Please help me to provide steps how certificate can be set .

Hello,

I do not have much experience with JavaScript, I'm trying to use splunk-logging to inject events from a dashboard in splunk through HEC but to follow in the footsteps throws me the following message page:

Uncaught Error: Module name "splunk-logging" has not been loaded yet for context: _. Use require([])

This is my javascript testhec.js :

var SplunkLogger = require('splunk-logging').Logger;
    var config = {
        token: "A9026FF3-0AE5-4401-AD54-69C89FFF8237",
        url: "https://localhost:8088"
    };
    var Logger = new SplunkLogger(config);
    Logger.error = function(err, context) {
        // Handle errors here
        console.log("error", err, "context", context);
    };
    var payload = {
        // Message can be anything, it doesn't have to be an object
        message: {
            Serial: 235689,
            Maquina: "Konica 1020",
            CF: 42658
        },
        // Metadata is optional
        metadata: {
            source: "hec_contador",
            sourcetype: "hec",
            index: "contador",
            host: "dataanalytics"
        },
        // Severity is also optional
        severity: "info"
    };
    console.log("Sending payload", payload);
    Logger.send(payload, function(err, resp, body) {
        // If successful, body will be { text: 'Success', code: 0 }
        console.log("Response from Splunk", body);
    });

This is the path module:

$SPLUNK_HOME/etc/apps/rentas/appserver/static/splunk-logging

This is XML code:

<form script="testhec.js.js">
  <label>TestHEC</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1"></input>
    <input type="dropdown" token="field2"></input>
    <input type="text" token="field3"></input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Track contadores</title>
        <search>
          <query>index="contador" sourcetype="contadorcsv" | stats values(Serial) as Serial values(Maquina) as Maquina values(CF) as CF by _time | autoregress CF as CI p=1 | delta CF as DIFF</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>

Thank you very much for the help

See here for requests deprecation. Will this be removed as a dependency?

Given request/request#3142 and the request module going into "maintenance mode", is there a plan for using an alternative package for this library?

Without any batching options set, my log sends immediately as expected. If I set batchInterval to 10000, my log still sends immediately. This is not expected. What is expected is that my logs would be sent every 10 seconds. If I set maxBatchSize to 100000 and send a few characters in the message, my log is sent immediately, so it doesn't appear to respect the size limit. maxBatchCount works as expected.

Looks like this library assumes that the token that was provided is a session token (by sending it along with Splunk authentication type). Are there any plans to support API/Bearer tokens also?

Using: [email protected]

splunk-logging is depending on the fixed version 2.61.0 of the request module which has a vulnerability, see the following advisory of NSP https://nodesecurity.io/advisories/309

Is there a special reason why you've version-locked the request module? If not please update as soon as possible.

Thanks a lot!

Error: ./node_modules/aws-sign2/index.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\aws-sign2'
Error: ./node_modules/aws4/aws4.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\aws4'

Error: ./node_modules/ecc-jsbn/index.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\ecc-jsbn'

Error: ./node_modules/http-signature/lib/signer.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\http-signature\lib'

Error: ./node_modules/http-signature/lib/verify.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\http-signature\lib'

Error: ./node_modules/oauth-sign/index.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\oauth-sign'

Error: ./node_modules/request/lib/helpers.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request\lib'

Error: ./node_modules/request/lib/oauth.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request\lib'

Error: ./node_modules/request/lib/hawk.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request\lib'

Error: ./node_modules/sshpk/lib/key.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/fingerprint.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/signature.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/private-key.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/certificate.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/identity.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/dhe.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/utils.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/formats/pem.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib\formats'

Error: ./node_modules/sshpk/lib/formats/ssh-private.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib\formats'

Error: ./node_modules/sshpk/lib/formats/openssh-cert.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib\formats'

Error: ./node_modules/request/lib/har.js
Module not found: Error: Can't resolve 'fs' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request\lib'

Error: ./node_modules/forever-agent/index.js
Module not found: Error: Can't resolve 'http' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\forever-agent'

Error: ./node_modules/http-signature/lib/signer.js
Module not found: Error: Can't resolve 'http' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\http-signature\lib'

Error: ./node_modules/request/request.js
Module not found: Error: Can't resolve 'http' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request'

Error: ./node_modules/tunnel-agent/index.js
Module not found: Error: Can't resolve 'http' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\tunnel-agent'

[0mError: ./node_modules/forever-agent/index.js
Module not found: Error: Can't resolve 'https' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\forever-agent'

Error: ./node_modules/request/request.js
Module not found: Error: Can't resolve 'https' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request'

Error: ./node_modules/tunnel-agent/index.js
Module not found: Error: Can't resolve 'https' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\tunnel-agent'

Error: ./node_modules/forever-agent/index.js
Module not found: Error: Can't resolve 'net' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\forever-agent'

Error: ./node_modules/tough-cookie/lib/cookie.js
Module not found: Error: Can't resolve 'net' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\tough-cookie\lib'

Error: ./node_modules/tunnel-agent/index.js
Module not found: Error: Can't resolve 'net' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\tunnel-agent'
Error: ./node_modules/mime-types/index.js
Module not found: Error: Can't resolve 'path' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\mime-types'

Error: ./node_modules/assert-plus/assert.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\assert-plus'

Error: ./node_modules/combined-stream/lib/combined_stream.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\combined-stream\lib'

Error: ./node_modules/delayed-stream/lib/delayed_stream.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\delayed-stream\lib'

Error: ./node_modules/isstream/isstream.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\isstream'

Error: ./node_modules/request/request.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request'

Error: ./node_modules/sshpk/lib/ed-compat.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/forever-agent/index.js
Module not found: Error: Can't resolve 'tls' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\forever-agent'

Error: ./node_modules/tunnel-agent/index.js
Module not found: Error: Can't resolve 'tls' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\tunnel-agent'
Error: ./node_modules/request/request.js
Module not found: Error: Can't resolve 'zlib' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request'

Error from chokidar (C:\node_modules): Error: EBUSY: resource busy or locked, lstat 'C:\pagefile.sys'
Error from chokidar (C:\node_modules): Error: EBUSY: resource busy or locked, lstat 'C:\swapfile.sys'
Error from chokidar (C:\node_modules): Error: EBUSY: resource busy or locked, lstat 'C:\pagefile.sys'
Error from chokidar (C:\node_modules): Error: EBUSY: resource busy or locked, lstat 'C:\swapfile.sys'
Error from chokidar (C:\node_modules): Error: EBUSY: resource busy or locked, lstat 'C:\pagefile.sys'
Error from chokidar (C:\node_modules): Error: EBUSY: resource busy or locked, lstat 'C:\swapfile.sys'
√ Browser application bundle generation complete.

Initial Chunk Files | Names | Size
main.js | main | 29.46 kB

4 unchanged chunks

Build at: 2021-05-03T10:32:51.549Z - Hash: 0f2fa5d218cc01eaf7d5 - Time: 1194ms

Error: ./node_modules/aws-sign2/index.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\aws-sign2'
Error: ./node_modules/aws4/aws4.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\aws4'

Error: ./node_modules/ecc-jsbn/index.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\ecc-jsbn'

Error: ./node_modules/http-signature/lib/signer.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\http-signature\lib'

Error: ./node_modules/http-signature/lib/verify.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\http-signature\lib'

Error: ./node_modules/oauth-sign/index.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\oauth-sign'

Error: ./node_modules/request/lib/helpers.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request\lib'

Error: ./node_modules/request/lib/oauth.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request\lib'

Error: ./node_modules/request/lib/hawk.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request\lib'

Error: ./node_modules/sshpk/lib/key.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/fingerprint.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/signature.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/private-key.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/certificate.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/identity.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/dhe.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/utils.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/sshpk/lib/formats/pem.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib\formats'

Error: ./node_modules/sshpk/lib/formats/ssh-private.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib\formats'

Error: ./node_modules/sshpk/lib/formats/openssh-cert.js
Module not found: Error: Can't resolve 'crypto' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib\formats'

Error: ./node_modules/request/lib/har.js
Module not found: Error: Can't resolve 'fs' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request\lib'

Error: ./node_modules/forever-agent/index.js
Module not found: Error: Can't resolve 'http' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\forever-agent'

Error: ./node_modules/http-signature/lib/signer.js
Module not found: Error: Can't resolve 'http' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\http-signature\lib'

Error: ./node_modules/request/request.js
Module not found: Error: Can't resolve 'http' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request'

Error: ./node_modules/tunnel-agent/index.js
Module not found: Error: Can't resolve 'http' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\tunnel-agent'

[0mError: ./node_modules/forever-agent/index.js
Module not found: Error: Can't resolve 'https' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\forever-agent'

Error: ./node_modules/request/request.js
Module not found: Error: Can't resolve 'https' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request'

Error: ./node_modules/tunnel-agent/index.js
Module not found: Error: Can't resolve 'https' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\tunnel-agent'

Error: ./node_modules/forever-agent/index.js
Module not found: Error: Can't resolve 'net' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\forever-agent'

Error: ./node_modules/tough-cookie/lib/cookie.js
Module not found: Error: Can't resolve 'net' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\tough-cookie\lib'

Error: ./node_modules/tunnel-agent/index.js
Module not found: Error: Can't resolve 'net' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\tunnel-agent'
Error: ./node_modules/mime-types/index.js
Module not found: Error: Can't resolve 'path' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\mime-types'

Error: ./node_modules/assert-plus/assert.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\assert-plus'

Error: ./node_modules/combined-stream/lib/combined_stream.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\combined-stream\lib'

Error: ./node_modules/delayed-stream/lib/delayed_stream.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\delayed-stream\lib'

Error: ./node_modules/isstream/isstream.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\isstream'

Error: ./node_modules/request/request.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request'

Error: ./node_modules/sshpk/lib/ed-compat.js
Module not found: Error: Can't resolve 'stream' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\sshpk\lib'
Error: ./node_modules/forever-agent/index.js
Module not found: Error: Can't resolve 'tls' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\forever-agent'

Error: ./node_modules/tunnel-agent/index.js
Module not found: Error: Can't resolve 'tls' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\tunnel-agent'
Error: ./node_modules/request/request.js
Module not found: Error: Can't resolve 'zlib' in 'C:\Users\AH28474\Angularlogging\ang-log-test\node_modules\request'

I've set HTTP_PROXY, HTTPS_PROXY. I verified the connectivity using curl in the machine which I tried this library. curl, node's native fetch works fine and pushes the logs. Only this library gives error with proxy. The code snippets which I tried are below,

fetch example

import proxy from "undici";

const proxyUrl = new URL("proxy url");

const agent = new proxy.ProxyAgent({
  uri: proxyUrl.protocol + proxyUrl.host,
});

fetch(
  "https://domain:443/services/collector/event/1.0",
  {
    dispatcher: agent,
    method: "POST",
    body: '{}',
    headers: {
      "Content-type": "application/json; charset=UTF-8",
      authorization: "Splunk token",
    },
  }
)
  .then((res) => {
    console.log("== res", res.statusText);
  })
  .catch((e) => {
    console.log("== err", e);
  });

This is working.

splunk-logging example

import splunk from "splunk-logging";

let token = "";
let index = "";

let logger = new splunk.Logger({
  port: 443,
  token,
  url: "",
});

logger.send(
  {
    message: {
      message: "",
      timestamp: new Date(),
    },
    severity: "error",
    metadata: {
      source: "",
      sourcetype: "",
      index
    },
  },
  (error, req, res) => {
    console.log(error);
    console.log(res);
  }
);

This throws an error ERROR: Error: connect ENETUNREACH

Version of this project you're using: 0.10.1
Platform version Mac OSX 10.14 (18A391)
Framework version: v10.12.0
Splunk version: not sure, but it should be the newest because it was just installed

When I copied and pasted in the tutorial in the readme I got back Data channel is missing. According to this help document: https://answers.splunk.com/answers/389554/why-am-i-getting-error-data-channel-is-missing-usi.html. I need to add a channel. There is no built-in way of doing this. maybe I just need to use the whole URL with the channel included?

I am trying to set custom path with S3.

path should change dynamically as per the log request.

example:
path : /splunk/log

here we want to change the path as per the request.
we will push json object as below:

{
    "streams":
        [
            {
                "stream":
                {
                    "refNum":"something"
                },
                "values":
                [
                    ["1643323824886697738","Test"]
                ]
            }
        ]
}

now as per the above json object prefix should be /something, this "something" is refNum in json obj.

Based on the documentation of the event metadata types in 8.1.1
https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/FormateventsforHTTPEventCollector

Thanks!

Hi,

Would like to question the rationale of appending severity to events when severity is not set. Given licensing is per byte of ingestion appending this data to billions of events when not wanted is costing $$.

Other than a custom formatter is there another way to disable this behaviour?

https://github.com/splunk/splunk-javascript-logging/blob/master/splunklogger.js#L47

Thanks

The javascript logger does not support adding "fields" to the metadata as described here

It looks like it should be as simple as adding a conditional to here

like:

if (context.metadata.hasOwnProperty("fields")) {
    metadata.fields = context.metadata.fields;
}

Version: 0.10.1
Platform: AWS Lambda
Framework version: Node 10.x
Splunk version: 7.2.6

Here's the code I'm using (got it directly from your npmjs page):

var SplunkLogger = require('splunk-logging').Logger;

var config = {
token: '',
url: ''
};

var Logger = new SplunkLogger(config);

var payload = {
// Message can be anything; doesn't have to be an object
message: {
temperature: "70F",
chickenCount: 500
}
};

console.log("Sending payload", payload);
Logger.send(payload, function(err, resp, body) {
// If successful, body will be { text: 'Success', code: 0 }
console.log("Response from Splunk", body);
});

And I always get this error:
/home/adinglasan/Desktop/splunk/node_modules/splunk-logging/splunklogger.js:466
if (!requestError && body && body.code.toString() !== "0") {
^

TypeError: Cannot read property 'toString' of undefined
at Request._callback (/home/adinglasan/Desktop/splunk/node_modules/splunk-logging/splunklogger.js:466:55)

I'm probably just using this library wrong, but I can't seem to send the event I want to send to the HTTP event collector.

I want to send a logging event with an event attribute including both a message and metadata like,

{
    "time": 1426279439, 
    "host": "...",
    "source": "...",
    "sourcetype": "...",
    "index": "...",
    "event": { 
      "message": "logging message goes here",
      "app": "some miscellaneous metadata",
      "moreMetadata": "actually, there's lots of metadata for the event",
      "severity": "info"
   }
}

I've tried several ways to interact with the Logger.send(...) method without success. First:

const payload = {
  message: "logging message goes here",
  app: "some miscellaneous metadata",
  moreMetadata: "actually, there's lots of metadata for the event",
  severity: "info"
}
splunkLogger.send(payload, err => {
  // ...
})

The event that makes it into splunk is just the "message" and "severity" fields. I can confirm that the request sent from the library, splunklogger.js:459, is missing the extra metadata fields:

{ json: true,
  strictSSL: false,
  headers: 
   { Authorization: 'xxxxx',
      'Content-Type': 'application/x-www-form-urlencoded' },
   body: '{"time":"1465482320.275","event":{"message":"logging message goes here","severity":"info"}}',
   url: 'http://...' }

... and the result in Splunk:

I've also tried putting the metadata under, metadata, but that seems to be reserved for source, sourcetype, index and host.

I've also tried putting all the the info under an additional message attribute:

const payload = {
  message: {
    message: "logging message goes here",
    app: "some miscellaneous metadata",
    moreMetadata: "actually, there's lots of metadata for the event",
    severity: "info"
  }
}
splunkLogger.send(payload, err => {
  // ...
})

...and while it does come through...

...we don't want those fields to be message.message or message.app, we really want it at the top level.

I can create and POST the event I want directly to the endpoint and it works as expected. Is there any way to do it with this library?

Im using node 14 and typescript and usually import using the syntax import {xxxxx} from "xxxxxx" ... how should be in this case?

https://apps.samsung.com/appquery/appDetail.as?appId=com.discord

If a Splunk HEC is running on a port < 1000 (e.g: 443), splunk-logging refuses to use this port (what is exactly the reason behind this?).
If I modify the source code (splunklogger.js:192, version 0.8.0 ) and lower this check, everything works fine.

IMHO, splunk-logging should not decide on which ports HEC can or can't run...

Trying to implement the same example as mentioned in the README file but getting the error:
ECONNRESET Error: socket hang up error

Have checkup the token and splunk HEC endpoint, it's working.
Can someone please help

Tried on:
Node version: v14.17.6

"dependencies": {
"splunk-logging": "^0.11.1"
}

I know the splunk cloud trial doesn't have proper ssl certificates, so it makes some sense to not require it by default. However, i would much rather prefer to have strict security enabled by default, and actively disable it if I want. Or at least mention in the documentation that the default options in this package are not secure.

Im able to send logs via postman and I need to add a header, how can I do the same in the code, I tried the following:

const URL = "https://<URL>/services/collector/raw"
const TOKEN = "123456-1234-1234-123456"
const Logger = new SplunkLogger({
    token: TOKEN,
    url: URL,
    headers: {
        'X-Splunk-Request-Channel': TOKEN
}

})

Thanks