search

PowerSchill / minecraft-app

Splunking Minecraft with the App Framework
Apache License 2.0
1 stars 0 forks source link

Update messages to utilize full JSON specs #23

Closed PowerSchill closed 8 years ago

PowerSchill commented 8 years ago

Right now only the event field is being sent to Splunk. Instead we should be using the HTTP Event Collector specification and send time, source, sourcetype, etc.

This will fix the issue with the Splunk time not matching the actual record.

PowerSchill commented 8 years ago

HEC spec from http://dev.splunk.com/view/event-collector/SP-CAAAE6M

{ "time": 1426279439, "host": "localhost", "source": "datasource", "sourcetype": "txt", "index": "main", "event": { "hello": "world" } }

PowerSchill commented 8 years ago

With commit 57b48c95e228ddade73c2f371a8d274525c41017 time, host, source, and sourcetype are now added to event data.