out_splunk: Add auto_extract_timestamp parameter

[cosmo0920]

Closes #5566.

• Added auto_extract_timestamp boolean to splunk.c, defaulting to off.
• When enabled, requests use /services/collector/event?auto_extract_timestamp=true, matching [Splunk’s HEC documentation](https://help.splunk.com/en/data-management/collect-http-event-data/use-hec-in-splunk-cloud-platform/http-event-collector-rest-api-endpoints).
• Added default and enabled request-capture coverage under the dedicated out_splunk scenario.
• Wrapped wait_for_requests(1) in try/finally, ensuring Service.stop() always runs.
• Suppressed the HEC envelope time field when auto_extract_timestamp is enabled in both pack_map() and pack_event_key(). This matches [Splunk’s documented timestamp precedence](https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.4/get-data-with-http-event-collector/http-event-collector-rest-api-endpoints).
• Added integration coverage confirming:
  • Default mode retains envelope time.
  • Auto-extraction omits time.
  • Auto-extraction also works with event_key.

Validation:

• cmake --build build --target fluent-bit-bin flb-rt-out_splunk — passed.
• ctest --test-dir build -R '^flb-rt-out_splunk$' --output-on-failure — passed.
• Focused out_splunk integration suite — 3 passed.
• Diff whitespace checks — passed.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• New Features

  • Added an auto_extract_timestamp option for the Splunk output (off by default).
  • When enabled, the Splunk payload omits the top-level time field so Splunk can extract timestamps from event data (including when using event_key).
  • The output automatically uses the correct HTTP Event Collector endpoint and includes the required auto_extract_timestamp=true URL parameter.

• Tests

  • Added integration scenarios and coverage for default, auto_extract_timestamp, and event_key timestamp extraction.
  • Validates request path, query string, headers, and whether time is present in captured events.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Splunk output plugin adds an auto_extract_timestamp option, selects the matching HEC endpoint, and omits the envelope time field when enabled. Integration scenarios and parametrized tests validate default, map, and event_key payload behavior.

Changes

Splunk timestamp extraction

Layer / File(s)	Summary
Configurable timestamp extraction plugins/out_splunk/splunk.h, plugins/out_splunk/splunk.c	Adds the setting and endpoint macro, omits the envelope time field when enabled, and selects the HEC endpoint during flush.
Default and auto-extraction scenarios tests/integration/scenarios/out_splunk/config/*	Adds default, automatic timestamp extraction, and event_key integration configurations.
Captured request validation tests/integration/scenarios/out_splunk/tests/test_out_splunk_001.py	Manages the test receiver and validates request paths, queries, authorization, event types, and time field presence.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: edsiper

Sequence Diagram(s)

sequenceDiagram
  participant FluentBit
  participant SplunkHTTPReceiver
  participant IntegrationTest
  FluentBit->>SplunkHTTPReceiver: Send event to selected HEC endpoint
  SplunkHTTPReceiver-->>IntegrationTest: Capture request path, query, and authorization
  IntegrationTest->>IntegrationTest: Assert payload shape and envelope time

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The code adds the requested boolean setting, passes it as a HEC URL parameter, and keeps the feature covered by integration tests.
Out of Scope Changes check	✅ Passed	The changes stay focused on the Splunk auto_extract_timestamp feature and related tests, with no obvious unrelated additions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding the auto_extract_timestamp parameter to the Splunk output plugin.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cosmo0920-extract-timestamp-automatically-on-out_splunk

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/integration/scenarios/out_splunk/tests/test_out_splunk_001.py`:
- Around line 72-77: Ensure the test_out_splunk_auto_extract lifecycle always
stops the Service by wrapping wait_for_requests(1) in a try/finally and invoking
service.stop() in the finally block, preserving the existing request-wait
behavior on success and failure.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 47047932-e017-4df7-8896-c9c9914f1042

📥 Commits

Reviewing files that changed from the base of the PR and between cb7256c and f64c0a2.

📒 Files selected for processing (5)

• plugins/out_splunk/splunk.c
• plugins/out_splunk/splunk.h
• tests/integration/scenarios/out_splunk/config/out_splunk_auto_extract_timestamp.yaml
• tests/integration/scenarios/out_splunk/config/out_splunk_default.yaml
• tests/integration/scenarios/out_splunk/tests/test_out_splunk_001.py

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f64c0a2ee3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".