From 0b26a070e429471056d3dabfda09c0f521afe623 Mon Sep 17 00:00:00 2001 From: Luke Murphey Date: Thu, 23 Jan 2020 14:55:48 -0800 Subject: [PATCH] Updating event writer --- src/bin/syndication_app/event_writer.py | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/src/bin/syndication_app/event_writer.py b/src/bin/syndication_app/event_writer.py index 0e65897..302c1ef 100644 --- a/src/bin/syndication_app/event_writer.py +++ b/src/bin/syndication_app/event_writer.py @@ -13,7 +13,12 @@ import time import random import re -from splunk.appserver.mrsparkle.lib.util import make_splunkhome_path +from splunk.clilib.bundle_paths import make_splunkhome_path + +try: + basestring +except: + basestring = str # Python handles datetimes badly, really badly. Below is a UTC timezone implementation since # Python does not include one by default @@ -132,12 +137,6 @@ def event_to_string(self, result, event_time=None, ignore_empty_fields=True): # Escape special fields that Splunk will overwrite converted_key = self.convert_special_fields(key) - # Python 2+3 basestring - try: - basestring - except NameError: - basestring = str - # Do not include fields whose name is empty or none since this indicates that the field # should not be included at all if converted_key is None or len(converted_key) == 0: @@ -154,7 +153,7 @@ def event_to_string(self, result, event_time=None, ignore_empty_fields=True): result_value = str(result[key]) # If the field is blank then do not include it if we are supposed to exclude it - if result_value <= 0 and ignore_empty_fields == True: + if len(result_value) <= 0 and ignore_empty_fields == True: pass # Ignore this field and continue to the next field value else: #TODO: need to figure out if field names must be escaped