Export multiple events in a single request. Args: events: Events to export Returns: Tuple of (successful, failed) counts
(self, events: list[SIEMEvent])
| 91 | |
| 92 | async def export_batch(self, events: list[SIEMEvent]) -> tuple[int, int]: |
| 93 | """Export multiple events in a single request. |
| 94 | |
| 95 | Args: |
| 96 | events: Events to export |
| 97 | |
| 98 | Returns: |
| 99 | Tuple of (successful, failed) counts |
| 100 | """ |
| 101 | if not events: |
| 102 | return 0, 0 |
| 103 | |
| 104 | url = f"{self.hec_url}/services/collector/event" |
| 105 | |
| 106 | # Build batch payload (newline-delimited JSON) |
| 107 | payload_lines = [] |
| 108 | for event in events: |
| 109 | payload = { |
| 110 | "time": event.timestamp.timestamp(), |
| 111 | "host": event.target or "security-suite", |
| 112 | "source": self.source, |
| 113 | "sourcetype": self.sourcetype, |
| 114 | "index": self.index, |
| 115 | "event": event.to_dict(), |
| 116 | } |
| 117 | payload_lines.append(json.dumps(payload)) |
| 118 | |
| 119 | batch_payload = "\n".join(payload_lines) |
| 120 | |
| 121 | headers = { |
| 122 | "Authorization": f"Splunk {self.hec_token}", |
| 123 | "Content-Type": "application/json", |
| 124 | } |
| 125 | |
| 126 | try: |
| 127 | async with httpx.AsyncClient( |
| 128 | timeout=self.timeout, verify=self.verify_ssl |
| 129 | ) as client: |
| 130 | response = await client.post( |
| 131 | url, |
| 132 | content=batch_payload, |
| 133 | headers=headers, |
| 134 | ) |
| 135 | |
| 136 | if response.status_code == 200: |
| 137 | self.logger.info(f"Batch exported {len(events)} events to Splunk") |
| 138 | return len(events), 0 |
| 139 | else: |
| 140 | self.logger.error( |
| 141 | f"Splunk batch error: {response.status_code} - {response.text}" |
| 142 | ) |
| 143 | return 0, len(events) |
| 144 | |
| 145 | except Exception as e: |
| 146 | self.logger.error(f"Splunk batch export failed: {e}") |
| 147 | return 0, len(events) |
| 148 | |
| 149 | async def test_connection(self) -> bool: |
| 150 | """Test connection to Splunk HEC. |