Splunk output plugin doesn't send metadata like sourcetype and index in raw mode
- Dominant language
- C
- Stars
- 8.1k
- Forks
- 2k
- Avg merge
- 4d 20h
- Merged PRs (30d)
- 71
Description
## Bug Report
**Describe the bug**
When using splunk_send_raw=On the Splunk output plugin doesn't send the values set in event_host, event_source, event_sourcetype, event_sourcetype_key, event_index, event_index_key to Splunk. The section "Sending Raw Events" states that "if the option splunk_send_raw has been enabled, the user must take care to put all log details in the event field, and only specify fields known to Splunk in the top level event.
This might have been correct in the past, but the current official Splunk documentation describes that these fields can be passed as request parameters: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTinput#services.2Fcollector.2Fraw
And here you can find examples: https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples
**To Reproduce**
Setup Splunk output with event_* Metadata:
```
[INPUT]
Name dummy
Tag dummy
[OUTPUT]
Name splunk
Match *
Host 127.0.0.1
Port 8081
TLS On
TLS.Verify Off
Splunk_Send_Raw On
Splunk_Token aaaaaaa-bbbb-cccc-dddd-eeeeeeeeee
event_sourcetype cpudata
```
Observe the submitted URL request (see screenshot below) by using a proxy. It doesn't contain sourcetype as request parameter.
**Expected behavior**
The request to Splunk should contain a parameter "?sourcetype=cpudata"
**Screenshots**

**Your Environment**
* Version used: 1.9.3
**Additional context**
In my experience passing the metadata as field value doesn't work reliably. For example it is not possible to overwrite the index our sourcetype that is set in Splunk for the HEC collector token that is used.
Contributor guide
Assessment
This issue has not been assessed yet.