So this is bugging me. I've got the following script in an HTML form in Splunk:
//
// Get the collection of indexes
var myindexes = service.indexes();
// Get an index to send events to
myindexes.fetch(function(err, myindexes) {
var myindex = myindexes.item("main");
// Submit an event to the index
myindex.submitEvent("Case Opened - lit", {
sourcetype: "notes"
}, function(err, result, myindex) {
console.log("Submitted event: ", result);
});
});
//
Which works. But, if I add a line to use a variable instead of a literal string such as:
//
// Get the collection of indexes
var myindexes = service.indexes();
var event = "Date=" + form_Date + ", BacklogID=" + form_BacklogID + ", evtID=" + form_evtID + ", Comments=" + form_Comments + ", Author=" + form_Author;
// Get an index to send events to
myindexes.fetch(function(err, myindexes) {
var myindex = myindexes.item("main");
// Submit an event to the index
myindex.submitEvent(event, {
sourcetype: "siem:alarm:notes"
}, function(err, result, myindex) {
console.log("Submitted event: ", result);
});
});
//
it doesn't give an error, but it doesn't add the record either. I've debugged and stepped into the code and the var event does have data, but nothing gets pushed to the index.
What gives? Anybody have an idea?