Skip to content

Commit 51a9b05

Browse files
committed
Source, SourceType, and Index are all optional
Splunk will pick reasonable defaults if the first two are omitted. A default index is always assigned when a token in created in Splunk. However, the JSON request must not refer to a blank index if this default is to be used. Without the json omitempty, the log entry is written to the index "main" where you might not think to look.
1 parent f5369e7 commit 51a9b05

File tree

1 file changed

+6
-7
lines changed

1 file changed

+6
-7
lines changed

splunk/splunk.go

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,20 +13,19 @@ import (
1313

1414
// Event represents the log event object that is sent to Splunk when Client.Log is called.
1515
type Event struct {
16-
Time int64 `json:"time" binding:"required"` // epoch time in seconds
17-
Host string `json:"host" binding:"required"` // hostname
18-
Source string `json:"source" binding:"required"` // app name
19-
SourceType string `json:"sourcetype" binding:"required"` // Splunk bucket to group logs in
20-
Index string `json:"index" binding:"required"` // idk what it does..
21-
Event interface{} `json:"event" binding:"required"` // throw any useful key/val pairs here
16+
Time int64 `json:"time"` // epoch time in seconds
17+
Host string `json:"host"` // hostname
18+
Source string `json:"source,omitempty"` // optional description of the source of the event; typically the app's name
19+
SourceType string `json:"sourcetype,omitempty"` // optional name of a Splunk parsing configuration; this is usually inferred by Splunk
20+
Index string `json:"index,omitempty"` // optional name of the Splunk index to store the event in; not required if the token has a default index set in Splunk
21+
Event interface{} `json:"event"` // throw any useful key/val pairs here
2222
}
2323

2424
// Client manages communication with Splunk's HTTP Event Collector.
2525
// New client objects should be created using the NewClient function.
2626
//
2727
// The URL field must be defined and pointed at a Splunk servers Event Collector port (i.e. https://{your-splunk-URL}:8088/services/collector).
2828
// The Token field must be defined with your access token to the Event Collector.
29-
// The Source, SourceType, and Index fields must be defined.
3029
type Client struct {
3130
HTTPClient *http.Client // HTTP client used to communicate with the API
3231
URL string

0 commit comments

Comments
 (0)