simple HEC example

demo.py

#!/bin/usr/python3
import time
import random
import string
import sys
from splunk_http_event_collector import http_event_collector

# splunk_http_event_collector available from https://pypi.org/project/Splunk-HEC/


def getThing(foo):
    ''' return action value '''

    if foo == "action":
        options = ['Looked at a thing', 'Fixed a thing', 'Broke a thing', 'Turned a thing on', 'Turned a thing off']
    elif foo == "color":
        options = ['red', 'blue', 'green', 'yello']
    elif foo == "status":
        options = ['good', 'good', 'good', 'good', 'bad']

    return random.choices(options)[0]

def generate_payload(sessionId, payload):
    event = {}
    action = getThing("action")
    color = getThing("color")
    event.update({"msg": "trying stuff", "severity": "DEBUG", "action": action, "color": color, 
                  "sessionId":sessionId})
    payload = update_payload(payload, event)
    return payload
    
def update_payload(payload, event):
    payload.update({"time": time.time(), "event": event})
    return payload

def main():
    ''' log stuff via hec
    '''
    ## Update with your token generated from Splunk, and splunk server localhost or 0.0.0.0 typically works for docker, depending on platform.
    key = "XXXXX" 
    host = "localhost"

    hec = http_event_collector(key, host)
    print("starting")
    
    while True:

        if not hec.check_connectivity():
            print("hec connectivity failed")
            sys.exit(1)

        time.sleep(random.uniform(0.5, 5))
        sessionId = ''.join(random.choices(string.ascii_uppercase + string.digits, k=7))

        payload = {"time": time.time(), 
                   "source": "localhost", 
                   "sourcetype" : "devtalk"}
        event = {"sessionId": sessionId, "msg":"Starting to do stuff", "severity":"INFO"}

        payload.update({"event": event})        
        hec.sendEvent(payload)

        for i in range(random.randint(1,5)):
            payload = generate_payload(sessionId, payload)
            hec.sendEvent(payload)
            time.sleep(random.uniform(1,6))
        
        event.update({"msg": "All Finished with the things", "severity": "INFO"})

        payload = update_payload(payload, event)
        hec.sendEvent(payload)

if __name__ == "__main__":
    main()