Splunk App for Corda relies on having direct access to the environment where your Corda nodes are running. As such, you'll need to modify the start up command for your Corda nodes. The startup command is illustrated here. Take note of the new dependencies you'll have, mentioned above. You can find an example of how to obtain and install them here.
In addition to the two java agents, make sure you install the following on your corda node host:
- Splunk Universal Forwarder
Refer to the example node dockerfile for how to accomplish the above, or if you already have Splunk App for Infrastructure installed on your Splunk instance, follow the instructions in the App to add more data sources.
Splunk App for Corda relies on the Corda node logging in JSON. One of the most important updates you'll need to make to your Corda node startup is to specify a new logging configuration for Log4j2. You can see the full command here. Specifically, you'll find the logging config here, and will specify it like this:
java -Dlog4j.configurationFile=logging.xml -jar corda.jar
We have implemented a pattern for logging arbitrary data that is illustrated in the CorDapp used in the Docker example. This involves using
ThreadContext to put additional strings into your logging context.
You'll need to add 3 indexes to your Splunk installation.
Take note that you'll need to install our Splunk Apps and Add-ons to make sense of all of the new data being sent to your instance.
- Splunk App for Infrastructure
- Splunk Add-on for Infrastructure
- Splunk App for Corda
If you're installing manually in your environment, please consider GDI architecture outline below.
/opt/splunk/etc/system/local/props.confto tell splunk where to find the timestamp in the Corda JSON logs.
We've provided a fully functioning example of everything outlined above, and you can learn more in the Docker example's README.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.