splunk

Documentation

Index

• Constants
• func HandleHTTPCode(resp *http.Response) error
• type AccessTokenPassthroughConfig
• type AckRequest
• type Event
  • func (e Event) GetMetricValues() map[string]any
  • func (e Event) IsMetric() bool
  • func (e *Event) UnmarshalJSON(b []byte) error
• type HecToOtelAttrs
• type HostID
  • func ResourceToHostID(res pcommon.Resource) (HostID, bool)
• type HostIDKey

Constants

const (
	SFxAccessTokenHeader       = "X-Sf-Token"                       // #nosec
	SFxAccessTokenLabel        = "com.splunk.signalfx.access_token" // #nosec
	SFxEventCategoryKey        = "com.splunk.signalfx.event_category"
	SFxEventPropertiesKey      = "com.splunk.signalfx.event_properties"
	SFxEventType               = "com.splunk.signalfx.event_type"
	DefaultSourceTypeLabel     = "com.splunk.sourcetype"
	DefaultSourceLabel         = "com.splunk.source"
	DefaultIndexLabel          = "com.splunk.index"
	DefaultNameLabel           = "otel.log.name"
	DefaultSeverityTextLabel   = "otel.log.severity.text"
	DefaultSeverityNumberLabel = "otel.log.severity.number"
	HECTokenHeader             = "Splunk"
	HTTPSplunkChannelHeader    = "X-Splunk-Request-Channel"

	HecTokenLabel = "com.splunk.hec.access_token" // #nosec
	// HecEventMetricType is the type of HEC event. Set to metric, as per https://docs.splunk.com/Documentation/Splunk/8.0.3/Metrics/GetMetricsInOther.
	HecEventMetricType = "metric"
	DefaultRawPath     = "/services/collector/raw"
	DefaultHealthPath  = "/services/collector/health"
	DefaultAckPath     = "/services/collector/ack"
)

Constants for Splunk components.

const HeaderRetryAfter = "Retry-After"

Functions

func HandleHTTPCode

func HandleHTTPCode(resp *http.Response) error

HandleHTTPCode handles an http response and returns the right type of error in case of a failure.

Types

type AccessTokenPassthroughConfig

type AccessTokenPassthroughConfig struct {
	// AccessTokenPassthrough indicates whether to associate datapoints with an organization access token received in request.
	AccessTokenPassthrough bool `mapstructure:"access_token_passthrough"`
}

AccessTokenPassthroughConfig configures passing through access tokens.

type AckRequest

type AckRequest struct {
	Acks []uint64 `json:"acks"`
}

type Event

type Event struct {
	Time       float64        `json:"time,omitempty"`       // optional epoch time - set to zero if the event timestamp is missing or unknown (will be added at indexing time)
	Host       string         `json:"host"`                 // hostname
	Source     string         `json:"source,omitempty"`     // optional description of the source of the event; typically the app's name
	SourceType string         `json:"sourcetype,omitempty"` // optional name of a Splunk parsing configuration; this is usually inferred by Splunk
	Index      string         `json:"index,omitempty"`      // optional name of the Splunk index to store the event in; not required if the token has a default index set in Splunk
	Event      any            `json:"event"`                // type of event: set to "metric" or nil if the event represents a metric, or is the payload of the event.
	Fields     map[string]any `json:"fields,omitempty"`     // dimensions and metric data
}

Event represents a metric in Splunk HEC format

func (Event) GetMetricValues

func (e Event) GetMetricValues() map[string]any

GetMetricValues extracts metric key value pairs from a Splunk HEC metric.

func (Event) IsMetric

func (e Event) IsMetric() bool

IsMetric returns true if the Splunk event is a metric.

func (*Event) UnmarshalJSON

func (e *Event) UnmarshalJSON(b []byte) error

UnmarshalJSON unmarshals the JSON representation of an event

type HecToOtelAttrs

type HecToOtelAttrs struct {
	// Source indicates the mapping of the source field to a specific unified model attribute.
	Source string `mapstructure:"source"`
	// SourceType indicates the mapping of the sourcetype field to a specific unified model attribute.
	SourceType string `mapstructure:"sourcetype"`
	// Index indicates the mapping of the index field to a specific unified model attribute.
	Index string `mapstructure:"index"`
	// Host indicates the mapping of the host field to a specific unified model attribute.
	Host string `mapstructure:"host"`
}

HecToOtelAttrs defines the mapping of Splunk HEC metadata to attributes

type HostID

type HostID struct {
	// Key is the key name/type.
	Key HostIDKey
	// Value is the unique ID.
	ID string
}

HostID is a unique key and value (usually used as a dimension) to uniquely identify a host using metadata about a cloud instance.

func ResourceToHostID

func ResourceToHostID(res pcommon.Resource) (HostID, bool)

ResourceToHostID returns a boolean determining whether or not a HostID was able to be computed or not.

type HostIDKey

type HostIDKey string

HostIDKey represents a host identifier.

const (
	// HostIDKeyAWS AWS HostIDKey.
	HostIDKeyAWS HostIDKey = "AWSUniqueId"
	// HostIDKeyGCP GCP HostIDKey.
	HostIDKeyGCP HostIDKey = "gcp_id"
	// HostIDKeyAzure Azure HostIDKey.
	HostIDKeyAzure HostIDKey = "azure_resource_id"
	// HostIDKeyHost Host HostIDKey.
	HostIDKeyHost HostIDKey = conventions.AttributeHostName
)