From a1a4cbbf28b9583a68a371fad4b3324c1551d2d0 Mon Sep 17 00:00:00 2001
From: Sean Whalen <whalenster@gmail.com>
Date: Tue, 25 Sep 2018 10:01:02 -0400
Subject: [PATCH] Use correct splunk sourcetype format

---
 parsedmarc/__init__.py | 12 ++++++++++++
 parsedmarc/splunk.py   |  6 +++---
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/parsedmarc/__init__.py b/parsedmarc/__init__.py
index 62ab5d4..4523dcb 100644
--- a/parsedmarc/__init__.py
+++ b/parsedmarc/__init__.py
@@ -225,6 +225,18 @@ def human_timestamp_to_datetime(human_timestamp):
     return datetime.strptime(human_timestamp, "%Y-%m-%d %H:%M:%S")
 
 
+def human_timestamp_to_timestamp(human_timestamp):
+    """
+    Converts a human-readable timestamp into a into a UNIX timestamp
+
+    Args:
+        human_timestamp (str): A timestamp in `YYYY-MM-DD HH:MM:SS`` format
+
+    Returns:
+        float: The converted timestamp
+    """
+    return human_timestamp_to_datetime(human_timestamp).timestamp()
+
 def _get_ip_address_country(ip_address):
     """
     Uses the MaxMind Geolite2 Country database to return the ISO code for the
diff --git a/parsedmarc/splunk.py b/parsedmarc/splunk.py
index cd6306c..13ab216 100644
--- a/parsedmarc/splunk.py
+++ b/parsedmarc/splunk.py
@@ -17,7 +17,7 @@ class HECClient(object):
     # http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHEC
     # http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTinput#services.2Fcollector
 
-    def __init__(self, url, access_token, index="dmarc",
+    def __init__(self, url, access_token,index="dmarc",
                  source="parsedmarc", verify=True):
         """
         Initializes the HECClient
@@ -60,7 +60,7 @@ class HECClient(object):
         json_str = ""
         for report in aggregate_reports:
             data = self._common_data.copy()
-            data["sourcetype"] = "dmarc_aggregate"
+            data["sourcetype"] = "dmarc:aggregate"
             data["event"] = report.copy()
             json_str += "{0}\n".format(json.dumps(data))
 
@@ -86,7 +86,7 @@ class HECClient(object):
         json_str = ""
         for report in aggregate_reports:
             data = self._common_data.copy()
-            data["sourcetype"] = "dmarc_forensic"
+            data["sourcetype"] = "dmarc:forensic"
             data["event"] = report.copy()
             json_str += "{0}\n".format(json.dumps(data))