simonbence commented on a change in pull request #4714: URL: https://github.com/apache/nifi/pull/4714#discussion_r564631086
########## File path: nifi-nar-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/main/resources/docs/org.apache.nifi.processors.splunk.QuerySplunkIndexingStatus/additionalDetails.html ########## @@ -0,0 +1,76 @@ +<!DOCTYPE html> +<html lang="en"> +<!-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + http://www.apache.org/licenses/LICENSE-2.0 + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--> +<head> + <meta charset="utf-8" /> + <title>QuerySplunkIndexingStatus</title> + <link rel="stylesheet" href="/nifi-docs/css/component-usage.css" type="text/css" /> +</head> + +<body> +<h2>QuerySplunkIndexingStatus</h2> + +<p> + This processor is responsible for polling Splunk server and determine if a Splunk event is acknowledged at the time of + execution. For more details about the HEC Index Acknowledgement please see + <a href="https://docs.splunk.com/Documentation/Splunk/LATEST/Data/AboutHECIDXAck";>this documentation.</a> +</p> + +<h3>Prerequisites</h3> + +<p> + In order to work properly, the incoming flow files need to have the attributes "splunk.acknowledgement.id" and + "splunk.responded.at" filled properly. The flow file attribute "splunk.acknowledgement.id" should continue the "ackId" + contained by the response of the Splunk from the original put call. The flow file attribute "splunk.responded.at" + should contain the Unix Epoch the put call was answered by Splunk. It is suggested to use PutSplunkHTTP processor to execute + the put call and set these attributes. +</p> + +<h3>Unacknowledged and undetermined cases</h3> + +<p> + Splunk serves information only about successful acknowledgement. In every other case it will return a false value. This + includes unsuccessful or ongoing indexing and unknown acknowledgement identifiers. In order to avoid infinite tries, + QuerySplunkIndexingStatus gives user the possibility to set a "Maximum waiting time". False results from Splunk within + the specified waiting time will be handled as "undetermined" and are transferred to the "undetermined" relationship. + Flow files outside of this time range will be transferred to the "unacknowledged" relationship next time the processor is + triggered. In order to determine if the indexing of a given event is within the waiting time, the Unix Epoch stored in + the attribute specified by "Splunk Sent At Attribute Name" will be used. Setting "Maximum waiting time" too low might Review comment: You are correct, this remained here by mistake. Originally the name of this attribute was configurable but during review it was simplified. ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
