Module splunk 

Splunk HTTP Event Collector (HEC) compatible ingestion endpoint.

Clients point their base endpoint at /v1/splunk, so the full paths are e.g. /v1/splunk/services/collector/event and /v1/splunk/services/collector/health.

Structs

SplunkRawQueryParams

Query parameters for /services/collector/raw. channel is accepted but ignored until indexer acknowledgment lands. table, pipeline_name, version, and linebreaker are Greptime extensions (linebreaker opts into event breaking; without it the body is one event).

Constants

DEFAULT_SPLUNK_TABLE 🔒

Default table used when neither the event’s index nor a ?table= query param is provided.

HEC_HEALTHY_CODE 🔒

HEC response code for a healthy collector. Splunk returns {"text":"HEC is healthy","code":17}.

RAW_MESSAGE_COLUMN 🔒

Column holding the verbatim raw body on /raw (Splunk’s _raw). Named message to avoid clashing with /event’s event column (whose shape varies by client: string vs identity-flattened object).

Functions

apply_tag_columns 🔒

Retags Field columns to Tag per table (identity makes everything a Field) so the insert path adds them to the primary key. Tags are scoped by table name so a batch targeting multiple tables can’t cross-promote a same-named field. Identity-only: rebuilds under the default opt.

handle_event

POST /services/collector/event (+ /services/collector, /event/1.0 aliases). Parses HEC events, runs them through the pipeline (identity default, overridable), and inserts with metadata columns as tags.

handle_health

GET /services/collector/health (+ /1.0). Public (see PUBLIC_API_PREFIX), since clients probe it before sending. ack/token query params are ignored.

handle_raw

POST /services/collector/raw (+ /raw/1.0 alias). By default, the whole body is raw text stored verbatim as ONE event in the RAW_MESSAGE_COLUMN — multiline payloads (e.g. stack traces) are preserved intact. Explicit framing is opt-in via ?linebreaker= (see split_raw_body). Metadata comes from query params and applies to every event. channel (param or x-splunk-request-channel header) is accepted but ignored until indexer acknowledgment lands;

hec_event_to_map 🔒

Maps one HEC event to (table, per-event map, tag names): time->timestamp, index->table, host/source/sourcetype/fields->tags, event+rest->data. None if the event isn’t a JSON object.

hec_response 🔒

HEC response body {"text", "code"}; clients branch on code.

ingest_events 🔒

Like ingest_logs_inner, but retags metadata columns (identity default) before insert.

is_blank_event 🔒

A HEC event value is blank if it’s null or an empty/whitespace-only string.

is_splunk_request 🔒

parse_hec_events 🔒

Parses a HEC body into a flat list of events. Handles both batch forms: objects concatenated with any/no separator, and a top-level array (flattened).

parse_hec_time 🔒

HEC time: epoch seconds (optionally fractional); values past ~1e12 are read as milliseconds. None if absent/unparseable (caller falls back to ingest time).

raw_event_to_map 🔒

Maps one raw event to a per-event map: { greptime_timestamp: ts, message: <event>, <metadata columns> }. The event text is stored as it is.

raw_metadata 🔒

Collects request-level /raw metadata (host/source/sourcetype) present in the query params. The keys double as the tag-column names; values apply to every event in the request (HEC /raw metadata is request-level, unlike /event).

resolve_pipeline_and_ingest 🔒

Shared tail of /event and /raw: resolves the pipeline (identity default; overridable via param/header, with an optional ?version= pin), enables tag promotion + metadata-first primary-key ordering for the identity path only, runs the ingest, and maps the outcome to a HEC response.

sanitize_index 🔒

Coerces a Splunk index into a valid table name (NAME_PATTERN); None if empty.

split_raw_body 🔒

Splits a raw body into events. Without ?linebreaker=, the whole body is ONE event. With ?linebreaker=<literal> (percent-encoded, e.g. %0A for \n), the body is split on that literal delimiter; whitespace-only segments are dropped, segment content is kept verbatim.

validate_event 🔒

event missing -> 12, event blank -> 13. present, non-null but unparsable time -> 6.