fix: record accessor key for hec_token

Signed-off-by: Maneesh Singh <[email protected]>
fluent · May 3, 2024 · e16c2e0 · e16c2e0
1 parent 07475e7
commit e16c2e0
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/plugins/out_splunk/splunk.c b/plugins/out_splunk/splunk.c
@@ -353,9 +353,9 @@ static flb_sds_t extract_hec_token(struct flb_splunk *ctx, msgpack_object map,
     flb_sds_t hec_token;
 
     /* Extract HEC token (map which is from metadata lookup) */
-    if (ctx->event_sourcetype_key) {
-        hec_token = flb_ra_translate(ctx->ra_metadata_auth_key, tag, tag_len,
-                                     map, NULL);
+    if (ctx->metadata_auth_key) {
+        hec_token = flb_ra_translate_check(ctx->ra_metadata_auth_key, tag, tag_len,
+                                     map, NULL, FLB_TRUE);
         if (hec_token) {
             return hec_token;
         }

diff --git a/plugins/out_splunk/splunk_conf.c b/plugins/out_splunk/splunk_conf.c
@@ -263,7 +263,7 @@ struct flb_splunk *flb_splunk_conf_create(struct flb_output_instance *ins,
     }
 
     /* Currently, Splunk HEC token is stored in a fixed key, hec_token. */
-    ctx->metadata_auth_key = "hec_token";
+    ctx->metadata_auth_key = "$hec_token";
     if (ctx->metadata_auth_key) {
         ctx->ra_metadata_auth_key = flb_ra_create(ctx->metadata_auth_key, FLB_TRUE);
         if (!ctx->ra_metadata_auth_key) {