we are using currently Splunk 3.4.4. and trying to commit a search via the REST API.
Our problem is that if we are using the term:
it causes Splunk to stop working properly. Login is not possible anymore then to the web interface, data is not getting indexed, the system is basically "halting".
Here is the Code we are using:
What is it that we are doing wrong?
The Java SDK wasn't tested to work with Splunk 3.x so although in general it should be compatible, it might have some quirks.
The best way to debug is to see the logs produced by the sdk (it prints them to stdout by default)
Second, as you figured that Splunk hangs while executing dispatchAndWait, I'd recommend to set smgr.setMaxAttempts(int maxAttempts) to some non-zero value - right now it's being set for unlimited polling attempts by default.
If that doesn't help, I'd check splunkd.log for error messages and crash* files inside /var/log/splunk if there are any.
answered 13 Jan '10, 01:24