Log messages into Splunk  

Logging into an external logging system is a very common requirement for EDGE platform and one of the most common systems we need to log to is splunk.

There are multiple ways of logging into Splunk. Below are described a few ways to log:

For trying out this I installed Splunk enterprise on-prem.

1. Log over HTTP

As a step 1 we first configure HTTP Event Collector in Splunk. I did that following the tutorial here:

http://dev.splunk.com/view/event-collector/SP-CAAAE7F

Once you finish this then Splunk will be listening on port 8088 by default for incoming requests over HTTP/s

Then create a Service callout policy with a configuration like below to send logs over HTTP/s event Collector.

<ServiceCallout name="Log-to-Splunk">
    <DisplayName>Log to Splunk</DisplayName>
    <Properties/>
    <Request clearPayload="true" variable="myRequest">
        <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
        <Set>
            <Headers>
                <Header name="Authorization">Splunk PUT-SPLUNK-CODE_HERE</Header>
            </Headers>    
            <Payload contentType="application/json">
                {"event":"Logged from EDGE"}
            </Payload>    
            <Path>services/collector/event</Path>
            <Verb>POST</Verb>
        </Set>
    </Request>
    <Response>calloutResponse</Response>
    <HTTPTargetConnection>
        <Properties/>
        <URL>https://52.23.227.40:8088/</URL>
    </HTTPTargetConnection>
</ServiceCallout>

The logs appear like below in Splunk:

2. Log over TCP

The other option is to log via TCP or UDP using Message Logging Policy.

Both Apigee and splunk supports both the protocols. But Splunk recommends TCP, hence we will use that.

The policy will look like this:

<MessageLogging name="Log-to-splunk-over-TCP">
    <DisplayName>Log to splunk over TCP</DisplayName>
    <Syslog>
        <Message>Message = "Something happened and I am logging via TCP"</Message>
        <Host>XX.XX.XX.XX</Host>
        <Port>2900</Port>
        <Protocol>TCP</Protocol>
    <SSLInfo>
        <Enabled>true</Enabled>
    </SSLInfo>
    </Syslog>
</MessageLogging>

3. Log via javascript

You will also be able to log to splunk via javascript or node.js. You can find corresponding tutorials here: http://dev.splunk.com/view/javascript-sdk/SP-CAAAEC9

4. As @gbhandari points out there is one more option for logging into Splunk. But this is only applicable for Apigee on-prem (private cloud) customers.

You can use the message logging policy to log messages to local file system.Check here: http://docs.apigee.com/api-services/reference/message-logging-policy#location. You can install Splunk agents on those instances. Each Splunk agent can forward the messages logged to the Splunk server.