fixed HEC _time value

tomrade · Oct 9, 2020 · e915151 · e915151
1 parent e95eda2
commit e915151
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/lib/nom.py b/lib/nom.py
@@ -235,9 +235,11 @@ def send_to_hec(self,events):
         # why does splunk HEC not support valid JSON lists for batching :( :( :(
         batch_string = ""
         for event in events:
-            batch_string = batch_string + json.dumps({'event' : event}) + '\n'
+            #print(self.parse_date(event['time']).timestamp())
+            batch_string = batch_string + json.dumps({'event' : event, "time": self.parse_date(event['time']).timestamp(), "sourcetype" : "evtxnom"}) + '\n'
         #print(event)
         r = requests.post(splunk_uri, data=batch_string, headers=headers, verify=False)
+        #print(r.text)
         return r.status_code, r.text
     def ingest_file(self,filename):
         # Process 1 file ah ah ah