Use correct splunk sourcetype format

parsedmarc/__init__.py

@@ -225,6 +225,18 @@ def human_timestamp_to_datetime(human_timestamp):
     return datetime.strptime(human_timestamp, "%Y-%m-%d %H:%M:%S")
 
 
+def human_timestamp_to_timestamp(human_timestamp):
+    """
+    Converts a human-readable timestamp into a into a UNIX timestamp
+
+    Args:
+        human_timestamp (str): A timestamp in `YYYY-MM-DD HH:MM:SS`` format
+
+    Returns:
+        float: The converted timestamp
+    """
+    return human_timestamp_to_datetime(human_timestamp).timestamp()
+
 def _get_ip_address_country(ip_address):
     """
     Uses the MaxMind Geolite2 Country database to return the ISO code for the

parsedmarc/splunk.py

@@ -17,7 +17,7 @@ class HECClient(object):
     # http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHEC
     # http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTinput#services.2Fcollector
 
-    def __init__(self, url, access_token, index="dmarc",
+    def __init__(self, url, access_token,index="dmarc",
                  source="parsedmarc", verify=True):
         """
         Initializes the HECClient
@@ -60,7 +60,7 @@ class HECClient(object):
         json_str = ""
         for report in aggregate_reports:
             data = self._common_data.copy()
-            data["sourcetype"] = "dmarc_aggregate"
+            data["sourcetype"] = "dmarc:aggregate"
             data["event"] = report.copy()
             json_str += "{0}\n".format(json.dumps(data))
 
@@ -86,7 +86,7 @@ class HECClient(object):
         json_str = ""
         for report in aggregate_reports:
             data = self._common_data.copy()
-            data["sourcetype"] = "dmarc_forensic"
+            data["sourcetype"] = "dmarc:forensic"
             data["event"] = report.copy()
             json_str += "{0}\n".format(json.dumps(data))