1+ package splunk
2+
3+ import (
4+ "crypto/tls"
5+ "time"
6+ "bytes"
7+ "os"
8+ "net/http"
9+ "encoding/json"
10+ "errors"
11+ )
12+
13+ // event represents the log event object that is sent to Splunk when *HTTPCollector.Log is called.
14+ type Event struct {
15+ Time int64 `json:"time" binding:"required"` // epoch time in seconds
16+ Host string `json:"host" binding:"required"` // hostname
17+ Source string `json:"source" binding:"required"` // app name
18+ SourceType string `json:"sourcetype" binding:"required"` // Splunk bucket to group logs in
19+ Index string `json:"index" binding:"required"` // idk what it does..
20+ Event map [string ]string `json:"event" binding:"required"` // throw any useful key/val pairs here
21+ }
22+
23+ // HTTPCollector handles the connection to the Splunk server. Once initialized, you just call the *HTTPCollector.Log
24+ // function to send off an HTTP log event.
25+ type HTTPCollector struct {
26+ Url string `json:"url" binding:"required"`
27+ Token string `json:"token" binding:"required"`
28+ Source string `json:"source" binding:"required"`
29+ SourceType string `json:"sourcetype" binding:"required"`
30+ Index string `json:"index" binding:"required"`
31+ }
32+
33+ // Log takes in a map[string]string of key/val pairs that you would like sent to Splunk in a log event, and bundles them
34+ // with the timestamp, hostname, source, sourcetype, and index specified in the HTTPCollector initialization.
35+ //
36+ // These can be any values/variables available to you that are of use.
37+ // i.e. {"error": "critical info here", "status_code": "404"}
38+ func (sl * HTTPCollector ) Log (event map [string ]string ) (err error ){
39+ hostname , _ := os .Hostname ()
40+ // create Splunk log
41+ splunklog := Event {
42+ Time : time .Now ().Unix (),
43+ Host : hostname ,
44+ Source : sl .Source ,
45+ SourceType : sl .SourceType ,
46+ Index : sl .Index ,
47+ Event : event ,
48+ }
49+
50+ // Convert requestBody struct to byte slice to prep for http.NewRequest
51+ b , err := json .Marshal (splunklog )
52+ if err != nil {
53+ return err
54+ }
55+
56+ //log.Print(string(b[:])) // print what the splunk post body will be for checking/debugging
57+
58+ // make new request
59+ url := sl .Url
60+ req , err := http .NewRequest ("POST" , url , bytes .NewBuffer (b ))
61+ req .Header .Add ("Content-Type" , "application/json" )
62+ req .Header .Add ("Authorization" , "Splunk " + sl .Token )
63+ tr := & http.Transport {TLSClientConfig : & tls.Config {InsecureSkipVerify : true }} // turn off certificate checking
64+ client := & http.Client {Transport : tr }
65+
66+ // receive response
67+ res , err := client .Do (req )
68+ if err != nil {
69+ return err
70+ }
71+
72+ // If statusCode is not good, return error string
73+ switch res .StatusCode {
74+ case 200 :
75+ default :
76+ // Turn response into string and return it
77+ buf := new (bytes.Buffer )
78+ buf .ReadFrom (res .Body )
79+ responseBody := buf .String ()
80+ err = errors .New (responseBody )
81+ //log.Print(responseBody) // print error to screen for checking/debugging
82+ }
83+ return err
84+ }
0 commit comments