#NEWLINE# def _send_splunk( event , index_override = None , sourcetype_override = None ) : #NEWLINE# #INDENT# '\n    Send the results to Splunk.\n    Requires the Splunk HTTP Event Collector running on port 8088.\n    This is available on Splunk Enterprise version 6.3 or higher.\n\n    ' #NEWLINE# opts = _get_options ( ) #NEWLINE# logging . info ( 'Options: {0}' . format ( json . dumps ( opts ) ) ) #NEWLINE# http_event_collector_key = opts [ 'token' ] #NEWLINE# http_event_collector_host = opts [ 'indexer' ] #NEWLINE# splunk_event = http_event_collector ( http_event_collector_key , http_event_collector_host ) #NEWLINE# payload = { #NEWLINE# #INDENT# #NEWLINE# #UNINDENT# } #NEWLINE# if ( index_override is None ) : #NEWLINE# #INDENT# payload . update ( { #NEWLINE# #INDENT# 'index' : opts [ 'index' ] , #NEWLINE# #UNINDENT# } ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# payload . update ( { #NEWLINE# #INDENT# 'index' : index_override , #NEWLINE# #UNINDENT# } ) #NEWLINE# #UNINDENT# if ( sourcetype_override is None ) : #NEWLINE# #INDENT# payload . update ( { #NEWLINE# #INDENT# 'sourcetype' : opts [ 'sourcetype' ] , #NEWLINE# #UNINDENT# } ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# payload . update ( { #NEWLINE# #INDENT# 'index' : payload , #NEWLINE# #UNINDENT# } ) #NEWLINE# #UNINDENT# payload . update ( { #NEWLINE# #INDENT# 'event' : event , #NEWLINE# #UNINDENT# } ) #NEWLINE# logging . info ( 'Payload: {0}' . format ( json . dumps ( payload ) ) ) #NEWLINE# splunk_event . sendEvent ( payload ) #NEWLINE# return True