From dfd40c5d269fa9cd021fecc25d5f18a2eb714696 Mon Sep 17 00:00:00 2001 From: Artem Rys Date: Tue, 25 Apr 2023 16:53:33 +0200 Subject: [PATCH] fix: sourcetype renamed to sourcetype_ingested If we just use sourcetype, it is being shadowed by Splunk's own sourcetype field during the dashboard creation and does not properly reflect the sourcetype where the data is being ingested. --- solnlib/log.py | 2 +- tests/unit/test_log.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/solnlib/log.py b/solnlib/log.py index d002e415..a3637b17 100644 --- a/solnlib/log.py +++ b/solnlib/log.py @@ -259,7 +259,7 @@ def events_ingested( { "action": "events_ingested", "modular_input_name": modular_input_name, - "sourcetype": sourcetype, + "sourcetype_ingested": sourcetype, "n_events": n_events, }, ) diff --git a/tests/unit/test_log.py b/tests/unit/test_log.py index 941e7a25..d4db221f 100644 --- a/tests/unit/test_log.py +++ b/tests/unit/test_log.py @@ -195,5 +195,5 @@ def test_events_ingested(): mock_logger.log.assert_called_once_with( logging.INFO, - "action=events_ingested modular_input_name=modular_input_name sourcetype=sourcetype n_events=5", + "action=events_ingested modular_input_name=modular_input_name sourcetype_ingested=sourcetype n_events=5", )