ugh. I've done this before.

Author: jettero

hubblestack/extmods/returners/splunk_fdg_return.py

@@ -75,6 +75,7 @@ def returner(ret):
             timeout = opts['timeout']
             custom_fields = opts['custom_fields']
             http_event_collector_ssl_verify = opts['http_event_collector_ssl_verify']
+            http_event_index = opts['http_event_index']
 
             # Set up the fields to be extracted at index time. The field values must be strings.
             # Note that these fields will also still be available in the event data
@@ -88,6 +89,7 @@ def returner(ret):
             hec = http_event_collector(http_event_collector_key, http_event_collector_host,
                                        http_event_port=http_event_collector_port, http_event_server_ssl=hec_ssl,
                                        http_event_collector_ssl_verify=http_event_collector_ssl_verify,
+                                       http_event_index=http_event_index,
                                        proxy=proxy, timeout=timeout)
 
             data = ret['return']

hubblestack/extmods/returners/splunk_generic_return.py

@@ -53,6 +53,7 @@ def _build_hec(opts):
     http_event_collector_host = opts['indexer']
     http_event_collector_port = opts['port']
     hec_ssl = opts['http_event_server_ssl']
+    http_event_index = opts['http_event_index']
     proxy = opts['proxy']
     timeout = opts['timeout']
     http_event_collector_ssl_verify = opts['http_event_collector_ssl_verify']
@@ -61,6 +62,7 @@ def _build_hec(opts):
                                http_event_port=http_event_collector_port,
                                http_event_server_ssl=hec_ssl,
                                http_event_collector_ssl_verify=http_event_collector_ssl_verify,
+                               http_event_index=http_event_index,
                                proxy=proxy, timeout=timeout)
 
     return hec

hubblestack/hec/obj.py

@@ -131,6 +131,7 @@ def __str__(self):
 
 
     def __init__(self, token, http_event_server, host='', http_event_port='8088',
+                 http_event_index='default',
                  http_event_server_ssl=True, http_event_collector_ssl_verify=True,
                  max_bytes=_max_content_bytes, proxy=None, timeout=9.05,
                  disk_queue=False,
@@ -141,6 +142,7 @@ def __init__(self, token, http_event_server, host='', http_event_port='8088',
 
         self.timeout = timeout
         self.token = token
+        self.default_index = http_event_index
         self.batchEvents = []
         self.maxByteLength = max_bytes
         self.currentByteLength = 0
@@ -217,7 +219,8 @@ def __init__(self, token, http_event_server, host='', http_event_port='8088',
 
     def _payload_msg(self, message, *a):
         event = dict(loggername='hubblestack.hec.obj', message=message % a)
-        payload = dict(time=int(time.time()), sourcetype='hubble_log', event=event)
+        payload = dict(index=self.default_index,
+            time=int(time.time()), sourcetype='hubble_log', event=event)
         update_payload(payload)
         return str(Payload(payload))
 

hubblestack/hec/opt.py

@@ -137,6 +137,7 @@ def make_hec_args(opts):
     a  = (opts['token'], opts['indexer'])
     kw = {
         'http_event_port': opts['port'],
+        'http_event_index': opts['index'],
         'http_event_server_ssl': opts['http_event_server_ssl'],
         'http_event_collector_ssl_verify': opts['http_event_collector_ssl_verify'],
         'proxy': opts['proxy'],