Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-58866

Splunk plugin not sending json files

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved (View Workflow)
    • Priority: Minor
    • Resolution: Fixed
    • Component/s: splunk-devops-plugin
    • Labels:
      None
    • Environment:
      splunk-devops-plugin (version 1.7.4)
    • Similar Issues:
    • Released As:
      1.8.1

      Description

      There is a bug where splunk-devops-plugin doesn't send json files to Splunk.

      In pipeline mode, I send a json file to splunk:
      step([$class: 'SplunkArtifactNotifier', excludeFiles: '', includeFiles: 'data/jkmaster_installs.json', publishFromSlave: true, sizeLimit: '100MB', skipGlobalSplunkArchive: true])

      The console output looks like this when I run the job:
      11:41:35 sending files at job level, includes:data/jkmaster_installs.json excludes:11:41:36 sent [/home/jenkins/workspace/slan/plugin-recon/data/jkmaster_installs.json] to splunk in 1 events

      However when I try to find my json file in Splunk it is not there.

      This bug is present in splunk-devops-plugin version 1.7.2 and higher. I am able to send my json file to Splunk with version 1.7.1. I believe that this commit causes the issue: https://github.com/splunk/splunkforjenkins/commit/10227252b7bed9576995ea0df63b395060773031. When I take out the code from just this commit sending my json file works fine. 

       

        Attachments

          Activity

          Hide
          fengxx Ted Xiao added a comment -

          could you please add below conf to $SPLUNK_HOME/etc/system/local/limits.conf

          [http_input]
          # max request content length, bytes
          max_content_length = 10000000
          

          1.7.2 will send json file in single request instead of line by line so it can be parsed correctly, I guess your splunk http event collector discarded the input for length limit

          Show
          fengxx Ted Xiao added a comment - could you please add below conf to $SPLUNK_HOME/etc/system/local/limits.conf [http_input] # max request content length, bytes max_content_length = 10000000 1.7.2 will send json file in single request instead of line by line so it can be parsed correctly, I guess your splunk http event collector discarded the input for length limit
          Hide
          sophie_lan Sophie Lan added a comment -

          I just tested that but it didn't work. I also tried sending a very small json file (~200 bytes) with the latest splunk version but that also didn't work. The file I am attempting to send varies around 5mb-8mb.

          Show
          sophie_lan Sophie Lan added a comment - I just tested that but it didn't work. I also tried sending a very small json file (~200 bytes) with the latest splunk version but that also didn't work. The file I am attempting to send varies around 5mb-8mb.
          Show
          fengxx Ted Xiao added a comment - it will be fixed by https://github.com/jenkinsci/splunk-devops-plugin/pull/8 you can use https://repo.jenkins-ci.org/snapshots/com/splunk/splunkins/splunk-devops/1.8.1-SNAPSHOT/splunk-devops-1.8.1-20190815.162126-1.hpi for testing
          Hide
          sophie_lan Sophie Lan added a comment -

          Thanks, it works now.

          Show
          sophie_lan Sophie Lan added a comment - Thanks, it works now.

            People

            Assignee:
            fengxx Ted Xiao
            Reporter:
            sophie_lan Sophie Lan
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: