Adding splunk HEC support

[FutureSharks]

I built the container and tested it in our environment and it works well 🙂

[brennoo]

🎉

[max-rocket-internet]

Hi @repeatedly could we get this PR merged?

[max-rocket-internet]

Any update @repeatedly?

[repeatedly]

Need debian images and please add your name to README's maintainer section:

https://github.com/fluent/fluentd-kubernetes-daemonset#maintainers

[max-rocket-internet]

@repeatedly done and done

[repeatedly]

sorry for the late. Merged!

[max-rocket-internet]

No worries, thanks @repeatedly 🙂

[cdaringe]

a little more documentation would go a long way here. ive been scratchin at this for a bit. i see in -vv mode some contact being made (but not showing up in my indicies), but not sure what else is needed. not sure what all switches i need to flip on for everything to be zen. anyway, thx for making the effort to get something out at all :)

[cdaringe]

2018-12-15 07:16:03 +0000 [debug]: plugin/out_splunk_hec.rb:143:post_payload: Splunk response: {"text":"Success","code":0}

^ hundreds of these in the logs, but indicies all empty :( . i'd be super grateful for any hints!

[max-rocket-internet]

@cdaringe it might help to rule out fluentd for now and just test your HEC with curl: http://dev.splunk.com/view/event-collector/SP-CAAAE7F

Then find your message in your Splunk, work out the index etc.

[cdaringe]

Thanks. I meant to follow up. This plugin was doing great work, but splunk was tossing away the data due to an issue I'm still working out. Thanks for the feedback!