[
https://issues.apache.org/jira/browse/CAMEL-23447?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino reassigned CAMEL-23447:
----------------------------------------
Assignee: Andrea Cosentino
> camel-splunk: Reimplement on Splunk REST API to remove unmaintained Java SDK
> ----------------------------------------------------------------------------
>
> Key: CAMEL-23447
> URL: https://issues.apache.org/jira/browse/CAMEL-23447
> Project: Camel
> Issue Type: Improvement
> Components: camel-splunk
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> h2. Background
> The {{camel-splunk}} component was deprecated in 4.19 (CAMEL-23073) because
> it depends on the Splunk Java SDK ({{org.apache.servicemix.bundles.splunk}}
> 1.9.5_1, repackaging {{com.splunk:splunk}}), which has not had a real release
> since 2020 and is no longer recommended by Splunk.
> The producer side is already covered by {{camel-splunk-hec}} (HEC over
> HttpClient5, no SDK). However, the consumer side (search jobs, real-time
> search, saved searches) has no replacement, and users relying on it currently
> have no migration path other than calling the Splunk REST API by hand.
> There is no official OpenAPI / Swagger specification for the Splunk
> Enterprise or Splunk Cloud Platform REST API (only for the unrelated Splunk
> Cloud Services Platform, ACS, and Observability products), so code generation
> is not an option.
> h2. Proposal
> Reimplement {{camel-splunk}} on top of the Splunk REST API directly, using
> the same stack as {{camel-splunk-hec}} ({{httpclient5}} + Jackson), and
> remove the Splunk Java SDK dependency entirely. Once the rewrite is complete,
> the {{@Deprecated}} annotations can be removed and the component
> un-deprecated.
> The Splunk Java SDK is essentially a thin wrapper over the Splunk REST API,
> and the surface we actually use in the component is small.
> h3. Endpoints in scope
> * {{POST /services/search/jobs}} - create a search job
> ({{exec_mode=normal|blocking|oneshot}}, {{search_mode=normal|realtime}})
> * {{GET /services/search/jobs/{sid}}} - poll job status
> * {{GET /services/search/jobs/{sid}/results}} (and {{results_preview}}) -
> fetch results in JSON
> * {{POST /servicesNS/{user}/{app}/saved/searches/{name}/dispatch}} - dispatch
> a saved search
> Authentication: HTTP Basic and {{Authorization: Bearer <token>}} (Splunk auth
> tokens), matching the existing configuration.
> h3. URI compatibility
> Keep the existing endpoint URI scheme ({{splunk:<name>}}) and the existing
> {{ConsumerType}} enum ({{NORMAL}}, {{REALTIME}}, {{SAVEDSEARCH}}) so existing
> routes continue to work without changes.
> h3. Out of scope
> * {{TCP}} producer publish type. Splunk TCP input is line-delimited text over
> a socket; users can migrate to {{camel-netty}}/{{camel-mina}} with an
> equivalent route. The migration will be documented in the upgrade guide.
> * {{SUBMIT}} and {{STREAM}} producer publish types - already covered by
> {{camel-splunk-hec}} and the upgrade guide already points users there.
> h2. Implementation notes
> * Drop the {{org.apache.servicemix.bundles.splunk}} dependency; remove
> {{splunk-version}} from the parent POM if no longer referenced.
> * Add {{httpclient5}} and Jackson dependencies (already used by
> {{camel-splunk-hec}}).
> * Reuse the Splunk testcontainer image already configured in {{test-infra}}
> for integration tests.
> * Update {{src/main/docs/splunk-component.adoc}} to reflect the new
> implementation and remove the deprecation banner.
> * Update the 4.x upgrade guide to note the un-deprecation and the TCP
> migration guidance.
> h2. Acceptance criteria
> * {{camel-splunk}} no longer depends on the Splunk Java SDK.
> * All existing consumer endpoint URIs continue to work ({{splunk:normal}},
> {{splunk:realtime}}, {{splunk:savedsearch}}).
> * Producer {{submit}}/{{stream}} either delegate to HEC under the hood or are
> removed in favour of {{camel-splunk-hec}} (to be decided on PR).
> * {{TCP}} producer publish type is removed with documented migration to
> {{camel-netty}}.
> * Integration tests pass against the Splunk testcontainer.
> * {{@Deprecated}} annotations are removed and the upgrade guide is updated.
> ----
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
