[receiver/splunkhec] HEC metrics accepts empty string Event #38585
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Please add a changelog. |
splunkericl
reviewed
Mar 12, 2025
internal/splunk/common.go
Outdated
| @@ -66,7 +66,7 @@ type Event struct { | |||
|
|
|||
| // IsMetric returns true if the Splunk event is a metric. | |||
| func (e *Event) IsMetric() bool { | |||
| return e.Event == HecEventMetricType || (e.Event == nil && len(e.GetMetricValues()) > 0) | |||
| return e.Event == HecEventMetricType || ((e.Event == nil || e.Event == "") && len(e.GetMetricValues()) > 0) | |||
There was a problem hiding this comment.
Can you test against splunk if this is the correct check? I was told: As tested out, the event field is optional. When presented, it can also be any string and does not have to be of value metric. A possible way of updating this would be to change
There was a problem hiding this comment.
Testing it out and Splunk is only checking if the event has metric_name to determine it as a metrics. Any string in event or the absent of event does not change its type if it has at least one metric_name:* field.
let me update this
atoulme
approved these changes
Mar 14, 2025
hapatel-splunk
pushed a commit
to hapatel-splunk/opentelemetry-collector-contrib
that referenced
this pull request
Apr 24, 2025
…emetry#38585) <!--Ex. Fixing a bug - Describe the bug and how this fixes the issue. Ex. Adding a feature - Explain what this achieves.--> #### Description Splunk HEC metrics accepts metrics when `"event": ""`. This aligns with Splunk HEC behavior <!-- Issue number (e.g. open-telemetry#1234) or full URL to issue, if applicable. --> #### Link to tracking issue Fixes [38464](open-telemetry#38464) <!--Describe what testing was performed and which tests were added.--> #### Testing Unit tests <!--Describe the documentation added.--> #### Documentation <!--Please delete paragraphs that you did not use before submitting.-->
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Splunk HEC metrics accepts metrics when
"event": "". This aligns with Splunk HEC behaviorLink to tracking issue
Fixes 38464
Testing
Unit tests
Documentation