Skip to main content

Pub-Sub to Splunk using Dataflow

  • February 28, 2024
  • 3 replies
  • 22 views

atul_shal
Forum|alt.badge.img+3

Is there any article /guide on how to update this?

This is from dataflow job for pubsub to splunk -Log ingestion. Checking on Learn More link, I didn't find anything useful.

 

 

3 replies

atul_shal
Forum|alt.badge.img+3
  • Author
  • Bronze 2
  • March 20, 2024

I have created a parallel job with latest version of SDK with the similar configuration but dataflow worker is not writing log to Splunk

Showing the error -

Error writing to Splunk. StatusCode: 0, content: hec-xyz.com: Name or service not known, StatusMessage: null

 

Anyone encountered with this error?

 

Google team experts?

.

 


Forum|alt.badge.img+2
  • Staff
  • March 21, 2024

Hi @atul_shal,

Hopefully an expert will weigh in soon, but here are some resources you might find helpful:

  • Google Cloud Dataflow Documentation: The official documentation provides insights into common networking requirements, firewall configuration, and Splunk integration best practices. https://cloud.google.com/dataflow
  • Splunk Knowledge Base: Splunk documentation addresses configuration of the HTTP Event Collector (HEC), token management, and potential troubleshooting scenarios. https://docs.splunk.com/

Forum|alt.badge.img
  • Staff
  • March 22, 2024

I have created a parallel job with latest version of SDK with the similar configuration but dataflow worker is not writing log to Splunk

Showing the error -

Error writing to Splunk. StatusCode: 0, content: hec-xyz.com: Name or service not known, StatusMessage: null

 

Anyone encountered with this error?

 

Google team experts?

.

 


Possibly dependencies issues during upgrade of the sdk, Can you try running 

sudo apt-get -f install

 To download and install linux packages that might help with the dependencies.