[receiver/splunk_hec] Fix single metric value parsing (#33085)

**Description:**
 Fix single metric value parsing

**Link to tracking Issue:**
Fixes #33084

.chloggen/fix_hec_single_value.yaml

@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: splunkhecreceiver
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Fix single metric value parsing
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [33084]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []

internal/splunk/common.go

@@ -51,12 +51,16 @@ type Event struct {
 }
 
 // IsMetric returns true if the Splunk event is a metric.
-func (e Event) IsMetric() bool {
+func (e *Event) IsMetric() bool {
 	return e.Event == HecEventMetricType || (e.Event == nil && len(e.GetMetricValues()) > 0)
 }
 
 // GetMetricValues extracts metric key value pairs from a Splunk HEC metric.
-func (e Event) GetMetricValues() map[string]any {
+func (e *Event) GetMetricValues() map[string]any {
+	if v, ok := e.Fields["metric_name"]; ok {
+		return map[string]any{v.(string): e.Fields["_value"]}
+	}
+
 	values := map[string]any{}
 	for k, v := range e.Fields {
 		if strings.HasPrefix(k, "metric_name:") {

internal/splunk/common_test.go

@@ -22,6 +22,16 @@ func TestGetValues(t *testing.T) {
 	assert.Equal(t, map[string]any{"foo": "bar", "foo2": "foobar"}, metric.GetMetricValues())
 }
 
+func TestSingleValue(t *testing.T) {
+	metric := Event{
+		Fields: map[string]any{
+			"metric_name": "foo",
+			"_value":      123,
+		},
+	}
+	assert.Equal(t, map[string]any{"foo": 123}, metric.GetMetricValues())
+}
+
 func TestIsMetric(t *testing.T) {
 	ev := Event{
 		Event: map[string]any{},