From c9177f3342850158f41a03855eaa5b8722e018db Mon Sep 17 00:00:00 2001 From: Sean Whalen Date: Tue, 25 Sep 2018 15:50:53 -0400 Subject: [PATCH] Only save to Splunk when there are things to save --- parsedmarc/splunk.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/parsedmarc/splunk.py b/parsedmarc/splunk.py index e5ed768..19bd0d4 100644 --- a/parsedmarc/splunk.py +++ b/parsedmarc/splunk.py @@ -57,6 +57,9 @@ class HECClient(object): if type(aggregate_reports) == dict: aggregate_reports = [aggregate_reports] + if len(aggregate_reports) < 1: + return + data = self._common_data.copy() json_str = "" for report in aggregate_reports: @@ -101,20 +104,23 @@ class HECClient(object): if response["code"] != 0: raise SplunkError(response["text"]) - def save_forensic_reports_to_splunk(self, aggregate_reports): + def save_forensic_reports_to_splunk(self, forensic_reports): """ Saves forensic DMARC reports to Splunk Args: - aggregate_reports (list): A list of forensic report dictionaries + forensic_reports (list): A list of forensic report dictionaries to save in Splunk """ - if type(aggregate_reports) == dict: - aggregate_reports = [aggregate_reports] + if type(forensic_reports) == dict: + forensic_reports = [forensic_reports] + + if len(forensic_reports) < 1: + return json_str = "" - for report in aggregate_reports: + for report in forensic_reports: data = self._common_data.copy() data["sourcetype"] = "dmarc:forensic" data["event"] = report.copy()