{"id":17954,"library":"splunk-bunyan-logger","title":"Splunk HTTP Event Collector Stream for Bunyan","description":"The `splunk-bunyan-logger` package provides a Bunyan stream specifically designed to send structured log data to Splunk Enterprise or Splunk Cloud via the HTTP Event Collector (HEC). It acts as a bridge, allowing applications using the Bunyan JSON logging library to seamlessly integrate with Splunk's data ingestion capabilities. The current stable version is 0.11.0. While no explicit release cadence is provided, the recent update (0.11.0) indicates active maintenance, with the last update fixing deprecated internal dependencies. Key differentiators include its tight integration with Bunyan's streaming architecture, batching capabilities for efficient data transfer, and support for custom event formatting. It requires Node.js v4 or later (tested with v10 and v14) and Splunk Enterprise 6.3.0 or later, or Splunk Cloud.","status":"active","version":"0.11.0","language":"javascript","source_language":"en","source_url":"https://github.com/splunk/splunk-bunyan-logger","tags":["javascript","splunk","HTTP","event","collector","logging","stream","bunyan"],"install":[{"cmd":"npm install splunk-bunyan-logger","lang":"bash","label":"npm"},{"cmd":"yarn add splunk-bunyan-logger","lang":"bash","label":"yarn"},{"cmd":"pnpm add splunk-bunyan-logger","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"This package is a Bunyan stream; Bunyan itself is required for creating loggers and using this stream.","package":"bunyan","optional":false}],"imports":[{"note":"The library primarily exposes its functionality via CommonJS `require`. Direct ESM `import` is not officially supported and may lead to issues without a CJS-to-ESM wrapper.","wrong":"import splunkBunyan from 'splunk-bunyan-logger';","symbol":"splunkBunyan","correct":"const splunkBunyan = require('splunk-bunyan-logger');"},{"note":"The `createStream` factory method is a property of the object exported by the `splunk-bunyan-logger` module, not a direct named export in CommonJS.","wrong":"const { createStream } = require('splunk-bunyan-logger');","symbol":"createStream","correct":"const splunkBunyan = require('splunk-bunyan-logger');\nconst splunkStream = splunkBunyan.createStream(config);"},{"note":"The `Logger` class is instantiated via `bunyan.createLogger()`, not directly accessed as a property of the `bunyan` module.","wrong":"const Logger = require('bunyan').Logger;","symbol":"Logger","correct":"const bunyan = require('bunyan');\nconst Logger = bunyan.createLogger({ name: 'my logger', streams: [splunkStream] });"}],"quickstart":{"code":"const bunyan = require(\"bunyan\");\nconst splunkBunyan = require(\"splunk-bunyan-logger\");\n\nconst config = {\n    token: process.env.SPLUNK_HEC_TOKEN ?? \"your-splunk-hec-token-here\",\n    url: process.env.SPLUNK_HEC_URL ?? \"https://splunk.local:8088\"\n};\n\n// Create a SplunkStream instance\nconst splunkStream = splunkBunyan.createStream(config);\n\n// Optional: Add an error handler for the stream\nsplunkStream.on(\"error\", (err, context) => {\n    // Log error, update metric, etc.\n    console.error(\"Splunk HEC Logger Error:\", err, context);\n});\n\n// Create a Bunyan Logger instance, adding the SplunkStream\nconst Logger = bunyan.createLogger({\n    name: \"my-application-logger\",\n    streams: [\n        { stream: process.stdout, level: \"info\" }, // Also log to console\n        splunkStream\n    ]\n});\n\nconst payload = {\n    // Message can be anything, doesn't have to be an object\n    message: {\n        temperature: \"72F\",\n        humidity: \"60%\",\n        sensorId: \"TH-001\"\n    },\n    // Custom metadata for Splunk (optional)\n    sourcetype: \"_json\",\n    source: \"my-node-app\"\n};\n\nconsole.log(\"Sending payload to Splunk HEC...\");\nLogger.info(payload, \"Environment sensor data collected.\");\nLogger.warn(\"Potential anomaly detected in sensor readings.\");\nconsole.log(\"Payload sent (asynchronously).\");\n","lang":"javascript","description":"This example demonstrates how to configure a Bunyan logger with the `splunk-bunyan-logger` stream to send structured logs to Splunk HTTP Event Collector. It includes basic error handling and uses environment variables for sensitive configuration."},"warnings":[{"fix":"Set `splunkStream.logger.requestOptions.strictSSL = true;` after creating the stream instance if your Splunk HEC endpoint uses a valid SSL certificate.","message":"SSL certificate validation is disabled by default (`strictSSL = false`). For production environments, it is crucial to explicitly enable SSL certificate validation by setting `logger.requestOptions.strictSSL = true` to prevent man-in-the-middle attacks.","severity":"gotcha","affected_versions":">=0.1.0"},{"fix":"Carefully test any custom `requestOptions` after upgrading to 0.11.0. Consult `needle` library documentation for equivalent options.","message":"Version 0.11.0 replaced the underlying HTTP client from `request` to `needle`. If your application relied on specific `request` library options passed via `requestOptions`, these might behave differently or no longer be supported. Review `needle`'s documentation for compatibility.","severity":"breaking","affected_versions":"0.11.0"},{"fix":"Stick to `require()` for importing `splunk-bunyan-logger` in your Node.js applications or ensure your build setup correctly handles CommonJS module imports within an ESM context.","message":"The library primarily uses CommonJS `require()` syntax. While modern Node.js versions support ESM, directly using `import` statements for `splunk-bunyan-logger` may not work as expected without proper transpilation or a CJS-to-ESM wrapper.","severity":"gotcha","affected_versions":">=0.1.0"},{"fix":"Ensure `config.token` and `config.url` are correct. Verify network connectivity to the Splunk HEC endpoint and attach an `error` listener to your `splunkStream` instance to catch and log any transmission failures.","message":"The Splunk HTTP Event Collector (HEC) requires a valid token and a reachable URL. Incorrect configuration can lead to logs not being sent to Splunk, often failing silently unless an error handler is attached to the stream.","severity":"gotcha","affected_versions":">=0.1.0"}],"env_vars":null,"last_verified":"2026-04-23T00:00:00.000Z","next_check":"2026-07-22T00:00:00.000Z","problems":[{"fix":"Use `const splunkBunyan = require('splunk-bunyan-logger');` and then access `splunkBunyan.createStream(config);`. Do not use `const { createStream } = require('splunk-bunyan-logger');` or ESM `import { createStream } from 'splunk-bunyan-logger';`","cause":"Attempting to destructure a CommonJS module's default export when it returns an object, or an incorrect ESM named import.","error":"TypeError: splunkBunyan.createStream is not a function"},{"fix":"Either disable `strictSSL` (not recommended for production) by `splunkStream.logger.requestOptions.strictSSL = false;` or, preferably, configure Node.js to trust your self-signed certificate by setting the `NODE_EXTRA_CA_CERTS` environment variable to the path of your CA certificate file.","cause":"This error occurs when `strictSSL` is enabled, and the Splunk HEC endpoint uses a self-signed or otherwise untrusted SSL certificate without proper CA configuration in the Node.js environment.","error":"Error: self signed certificate in certificate chain"},{"fix":"Verify the `config.url` is correct (including port). Check network connectivity from your application server to the Splunk HEC host, and ensure Splunk HEC is enabled and listening on the specified port.","cause":"The application cannot establish a connection to the specified Splunk HTTP Event Collector URL. This could be due to an incorrect URL, wrong port, firewall blocking the connection, or the Splunk HEC service not running or configured correctly.","error":"Error: connect ECONNREFUSED <splunk-host>:<port>"}],"ecosystem":"npm","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}