Andrea Cosentino created CAMEL-23447:
----------------------------------------
Summary: camel-splunk: Reimplement on Splunk REST API to remove
unmaintained Java SDK
Key: CAMEL-23447
URL: https://issues.apache.org/jira/browse/CAMEL-23447
Project: Camel
Issue Type: Improvement
Components: camel-splunk
Reporter: Andrea Cosentino
h2. Background
The {{camel-splunk}} component was deprecated in 4.19 (CAMEL-23073) because it
depends on the Splunk Java SDK ({{org.apache.servicemix.bundles.splunk}}
1.9.5_1, repackaging {{com.splunk:splunk}}), which has not had a real release
since 2020 and is no longer recommended by Splunk.
The producer side is already covered by {{camel-splunk-hec}} (HEC over
HttpClient5, no SDK). However, the consumer side (search jobs, real-time
search, saved searches) has no replacement, and users relying on it currently
have no migration path other than calling the Splunk REST API by hand.
There is no official OpenAPI / Swagger specification for the Splunk Enterprise
or Splunk Cloud Platform REST API (only for the unrelated Splunk Cloud Services
Platform, ACS, and Observability products), so code generation is not an option.
h2. Proposal
Reimplement {{camel-splunk}} on top of the Splunk REST API directly, using the
same stack as {{camel-splunk-hec}} ({{httpclient5}} + Jackson), and remove the
Splunk Java SDK dependency entirely. Once the rewrite is complete, the
{{@Deprecated}} annotations can be removed and the component un-deprecated.
The Splunk Java SDK is essentially a thin wrapper over the Splunk REST API, and
the surface we actually use in the component is small.
h3. Endpoints in scope
* {{POST /services/search/jobs}} - create a search job
({{exec_mode=normal|blocking|oneshot}}, {{search_mode=normal|realtime}})
* {{GET /services/search/jobs/{sid}}} - poll job status
* {{GET /services/search/jobs/{sid}/results}} (and {{results_preview}}) -
fetch results in JSON
* {{POST /servicesNS/{user}/{app}/saved/searches/{name}/dispatch}} - dispatch a
saved search
Authentication: HTTP Basic and {{Authorization: Bearer <token>}} (Splunk auth
tokens), matching the existing configuration.
h3. URI compatibility
Keep the existing endpoint URI scheme ({{splunk:<name>}}) and the existing
{{ConsumerType}} enum ({{NORMAL}}, {{REALTIME}}, {{SAVEDSEARCH}}) so existing
routes continue to work without changes.
h3. Out of scope
* {{TCP}} producer publish type. Splunk TCP input is line-delimited text over a
socket; users can migrate to {{camel-netty}}/{{camel-mina}} with an equivalent
route. The migration will be documented in the upgrade guide.
* {{SUBMIT}} and {{STREAM}} producer publish types - already covered by
{{camel-splunk-hec}} and the upgrade guide already points users there.
h2. Implementation notes
* Drop the {{org.apache.servicemix.bundles.splunk}} dependency; remove
{{splunk-version}} from the parent POM if no longer referenced.
* Add {{httpclient5}} and Jackson dependencies (already used by
{{camel-splunk-hec}}).
* Reuse the Splunk testcontainer image already configured in {{test-infra}} for
integration tests.
* Update {{src/main/docs/splunk-component.adoc}} to reflect the new
implementation and remove the deprecation banner.
* Update the 4.x upgrade guide to note the un-deprecation and the TCP migration
guidance.
h2. Acceptance criteria
* {{camel-splunk}} no longer depends on the Splunk Java SDK.
* All existing consumer endpoint URIs continue to work ({{splunk:normal}},
{{splunk:realtime}}, {{splunk:savedsearch}}).
* Producer {{submit}}/{{stream}} either delegate to HEC under the hood or are
removed in favour of {{camel-splunk-hec}} (to be decided on PR).
* {{TCP}} producer publish type is removed with documented migration to
{{camel-netty}}.
* Integration tests pass against the Splunk testcontainer.
* {{@Deprecated}} annotations are removed and the upgrade guide is updated.
----
_Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
