What's new in the Splunk SDK for Java

Note: The Splunk® Plug-in for Eclipse is now available. It provides tooling to support creating projects in the Eclipse Integrated Development Environment (IDE) with the Splunk Software Development Kit (SDK) for Java, and for running Java applications with instrumentation on the Java Virtual Machine (JVM) that logs the application's activity to Splunk. Find out more!

The current version of the Splunk SDK for Java is 1.6.2. This topic summarizes the changes included in each version of the SDK.

For a detailed list of new features and APIs, breaking changes, and other changes, see the Splunk SDK for Java Changelog (/splunk-sdk-java/changelog.md).


Version 1.6.2 (2017-03-16) of the Splunk SDK for Java contains the following changes since the last release:

  • Updated modular input shims to ensure Java processes are killed.


Version 1.6.1 (2017-01-04) of the Splunk SDK for Java contains the following changes since the last release:

  • Fixed authentication issues when the Splunk Set-Cookie header is not the first one.


Here's what was new in version 1.6.0 (2016-11-30) of the Splunk SDK for Java:

  • New features and APIs
    • Add support for retrieving Password entities scoped by realm and username.
    • Added getter methods for embed SavedSearch properties.
    • Added support for custom HttpURLConnection connection timeouts on HttpService.
    • Performance improvement to SavedSearch.dispatch().
    • Added getter methods to the Job class for retrieving long values (getEventCountLong, getResultCountLong, getScanCountLong).
    • Added setFieldList() to the JobExportArgs class.
    • Added support for the manualRebuilds DataModel setting.
  • Bug Fixes
    • Fixed SavedSearch.Dispatch() throwing a NullPointerException in some load-balanced search head clustering environments.
    • Fixed non-limit PivotFilter constructing the wrong JSON blob.
  • Minor changes
    • Added support for Travis CI.


Here's what was new in version 1.5.0 (2015-08-10) of the SDK:

  • Added support for cookie-based authentication, for Splunk Enterprise 6.2.0 and later.
  • Fixed failure parsing XML responses. Pull Request #76.
  • Fixed bug where Job is never ready leading to infinite loops.
  • The SDK is now properly compiled with the Command class used in examples.


Here's what was new in version 1.4.0 (2015-04-13) of the SDK:

  • Added support for Java 8. You can manually configure the Service class to use TLSv1.2, TLSv1.1, or TLSv1 using the SSLSecurityProtocol enum. The default is still SSLv3.
  • Allow setting a custom SSLSocketFactory on the HTTPService and Service classes.
  • New ssl_protocols example: Tries to connect to Splunk Enterprise over HTTPS using different SSL/TLS protocols, then using a custom SSL and TLS SSLSocketFactory.


Here's what was new in version 1.3.2 of the SDK:

  • Performance improvements:
    • Job objects will only be refreshed by isReady() if the Job is not ready. This minimizes HTTP requests when getting properties of the Job.
    • The Service class now has a getJob() method that is used to retrieve a Job object by its sid String. This is better than calling service.getJobs().get(sid), which has the overhead of getting all Job objects from Splunk Enterprise in order to access a single Job.
  • New examples:
    • endpoint_instantiation: shows how to manually instantiate any Splunk Enterprise REST API endpoint.
    • get_job: shows how to get a Job by its sid using the new Service.getJob() method.
  • Minor changes:
    • The Entity and EntityCollection classes each have a public constructor, so any Splunk Enterprise endpoint can be manually instantiated.
    • The FiredAlert class now has a getParsedExpirationTime() method that returns a Date object.
    • Some test have been modified to work with the latest release of Splunk Enterprise (6.2.x).


Here's what was new in version 1.3.1 of the SDK:


Here's what was new in version 1.3.0 of the SDK:

  • Added support for data models and pivots.
  • Other bug fixes.


Here's what was new in version 1.2.2 of the SDK:


Here's what was new in version 1.2.1 of the SDK:

  • The Splunk SDK for Java is now fully compatible with Splunk Enterprise 6.0.
  • Other bug fixes. See CHANGELOG.md for details.


Here's what was new in version 1.2.0 of the SDK:


Here's what was new in version 1.1.0 of the SDK:

  • Multiple result sets for export searches

    New results readers let you read streams from export searches, which contain multiple results sets. For examples, see To work with results from an export search. For API documentation, see the MultiResultsReaderXml and MultiResultsReaderJson classes.

  • Segmentation

    Now, by default, segmentation is turned off in the results from search jobs—this means results are returned as raw text rather than XML. You can change this setting using the setSegmentation method in the JobEventsArgs and JobExportArgs classes.

    We've also added a getSegmentedRaw method to the Event class that returns raw data from events to preserve segmentation information.