diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 45672b441bd8..b2d75ef44df0 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -17420,6 +17420,16 @@ components: Must have HTTPS scheme and forwarding back to Datadog is not allowed. example: https://example.com type: string + sourcetype: + description: |- + The Splunk sourcetype for the events sent to this Splunk destination. + + If absent, the default sourcetype `_json` is used. If set to null, the `sourcetype` + field is omitted from the Splunk HEC payload entirely. Otherwise, the provided string + value is used as the sourcetype. + example: my-source + nullable: true + type: string type: $ref: "#/components/schemas/CustomDestinationForwardDestinationSplunkType" required: @@ -17695,6 +17705,16 @@ components: Must have HTTPS scheme and forwarding back to Datadog is not allowed. example: https://example.com type: string + sourcetype: + description: |- + The Splunk sourcetype for the events sent to this Splunk destination. + + If absent, the default sourcetype `_json` is used. If set to null, the `sourcetype` + field is omitted from the Splunk HEC payload entirely. Otherwise, the provided string + value is used as the sourcetype. + example: my-source + nullable: true + type: string type: $ref: "#/components/schemas/CustomDestinationResponseForwardDestinationSplunkType" required: diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_3048149063/frozen.json b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_3048149063/frozen.json new file mode 100644 index 000000000000..a781e27395e8 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_3048149063/frozen.json @@ -0,0 +1 @@ +"2026-03-25T16:23:47.455Z" diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_3048149063/recording.har b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_3048149063/recording.har new file mode 100644 index 000000000000..d7895440a5c7 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_3048149063/recording.har @@ -0,0 +1,109 @@ +{ + "log": { + "_recordingName": "Logs Custom Destinations/Create a Splunk custom destination with a null sourcetype returns \"OK\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "896b2ffddef9ece3cfc55bf21df0cd79", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 263, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 592, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":null,\"type\":\"splunk_hec\"},\"name\":\"Nginx logs\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations" + }, + "response": { + "bodySize": 360, + "content": { + "mimeType": "application/json", + "size": 360, + "text": "{\"data\":{\"id\":\"d328c779-9b3b-41c7-a952-20a7446eb7d1\",\"attributes\":{\"name\":\"Nginx logs\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":null},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 713, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:48.102Z", + "time": 518 + }, + { + "_id": "b0c9326a11bd84d51c31e1565da92ef4", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 0, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "*/*" + } + ], + "headersSize": 565, + "httpVersion": "HTTP/1.1", + "method": "DELETE", + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/d328c779-9b3b-41c7-a952-20a7446eb7d1" + }, + "response": { + "bodySize": 0, + "content": { + "mimeType": "text/html; charset=utf-8", + "size": 0 + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "text/html; charset=utf-8" + } + ], + "headersSize": 700, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 204, + "statusText": "No Content" + }, + "startedDateTime": "2026-03-25T16:23:48.629Z", + "time": 374 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3331479502/frozen.json b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3331479502/frozen.json new file mode 100644 index 000000000000..ff66eb3075c7 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3331479502/frozen.json @@ -0,0 +1 @@ +"2026-03-25T16:23:49.008Z" diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3331479502/recording.har b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3331479502/recording.har new file mode 100644 index 000000000000..90fbc72a5f10 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3331479502/recording.har @@ -0,0 +1,109 @@ +{ + "log": { + "_recordingName": "Logs Custom Destinations/Create a Splunk custom destination with a sourcetype returns \"OK\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "e40e6584080a0a976abbaac7f44042c6", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 274, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 592, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":\"my-sourcetype\",\"type\":\"splunk_hec\"},\"name\":\"Nginx logs\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations" + }, + "response": { + "bodySize": 371, + "content": { + "mimeType": "application/json", + "size": 371, + "text": "{\"data\":{\"id\":\"429e154f-5cf5-41ce-ae15-4bc41563f46f\",\"attributes\":{\"name\":\"Nginx logs\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":\"my-sourcetype\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 713, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:49.010Z", + "time": 648 + }, + { + "_id": "6f5cc353eb8006ad8ba4a0b573ec4fe5", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 0, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "*/*" + } + ], + "headersSize": 566, + "httpVersion": "HTTP/1.1", + "method": "DELETE", + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/429e154f-5cf5-41ce-ae15-4bc41563f46f" + }, + "response": { + "bodySize": 0, + "content": { + "mimeType": "text/html; charset=utf-8", + "size": 0 + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "text/html; charset=utf-8" + } + ], + "headersSize": 700, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 204, + "statusText": "No Content" + }, + "startedDateTime": "2026-03-25T16:23:49.664Z", + "time": 543 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-empty-string-sourcetype-returns-OK-response_3116751190/frozen.json b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-empty-string-sourcetype-returns-OK-response_3116751190/frozen.json new file mode 100644 index 000000000000..f10d0117b4d5 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-empty-string-sourcetype-returns-OK-response_3116751190/frozen.json @@ -0,0 +1 @@ +"2026-03-25T16:23:50.210Z" diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-empty-string-sourcetype-returns-OK-response_3116751190/recording.har b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-empty-string-sourcetype-returns-OK-response_3116751190/recording.har new file mode 100644 index 000000000000..4de3bac9edf0 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-empty-string-sourcetype-returns-OK-response_3116751190/recording.har @@ -0,0 +1,109 @@ +{ + "log": { + "_recordingName": "Logs Custom Destinations/Create a Splunk custom destination with an empty string sourcetype returns \"OK\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "8f9868734882068ec4ad8e924082c5d3", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 261, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 592, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":\"\",\"type\":\"splunk_hec\"},\"name\":\"Nginx logs\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations" + }, + "response": { + "bodySize": 358, + "content": { + "mimeType": "application/json", + "size": 358, + "text": "{\"data\":{\"id\":\"cb6c24f4-f420-42dd-bc86-ce51e03f7968\",\"attributes\":{\"name\":\"Nginx logs\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":\"\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 713, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:50.213Z", + "time": 1034 + }, + { + "_id": "2868263b6837d9dc48b20187b7a96820", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 0, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "*/*" + } + ], + "headersSize": 566, + "httpVersion": "HTTP/1.1", + "method": "DELETE", + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/cb6c24f4-f420-42dd-bc86-ce51e03f7968" + }, + "response": { + "bodySize": 0, + "content": { + "mimeType": "text/html; charset=utf-8", + "size": 0 + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "text/html; charset=utf-8" + } + ], + "headersSize": 699, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 204, + "statusText": "No Content" + }, + "startedDateTime": "2026-03-25T16:23:51.253Z", + "time": 510 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-invalid-sourcetype-returns-Bad-Request-response_668461555/frozen.json b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-invalid-sourcetype-returns-Bad-Request-response_668461555/frozen.json new file mode 100644 index 000000000000..6d2c085c4b44 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-invalid-sourcetype-returns-Bad-Request-response_668461555/frozen.json @@ -0,0 +1 @@ +"2026-03-25T16:23:51.766Z" diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-invalid-sourcetype-returns-Bad-Request-response_668461555/recording.har b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-invalid-sourcetype-returns-Bad-Request-response_668461555/recording.har new file mode 100644 index 000000000000..1179bada670f --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-invalid-sourcetype-returns-Bad-Request-response_668461555/recording.har @@ -0,0 +1,67 @@ +{ + "log": { + "_recordingName": "Logs Custom Destinations/Create a Splunk custom destination with an invalid sourcetype returns \"Bad Request\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "693f4f26e2cee7c2ced9dc68aa07dd81", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 262, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 593, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":123,\"type\":\"splunk_hec\"},\"name\":\"Nginx logs\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations" + }, + "response": { + "bodySize": 94, + "content": { + "mimeType": "application/json", + "size": 94, + "text": "{\"errors\":[\"Invalid custom destination configuration\",\"Sourcetype must be a string or null\"]}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 711, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 400, + "statusText": "Bad Request" + }, + "startedDateTime": "2026-03-25T16:23:51.776Z", + "time": 340 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-without-a-sourcetype-returns-OK-response_2788694778/frozen.json b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-without-a-sourcetype-returns-OK-response_2788694778/frozen.json new file mode 100644 index 000000000000..919d687322e6 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-without-a-sourcetype-returns-OK-response_2788694778/frozen.json @@ -0,0 +1 @@ +"2026-03-25T16:23:52.120Z" diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-without-a-sourcetype-returns-OK-response_2788694778/recording.har b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-without-a-sourcetype-returns-OK-response_2788694778/recording.har new file mode 100644 index 000000000000..ad5c73e00270 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-without-a-sourcetype-returns-OK-response_2788694778/recording.har @@ -0,0 +1,109 @@ +{ + "log": { + "_recordingName": "Logs Custom Destinations/Create a Splunk custom destination without a sourcetype returns \"OK\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "c5f2cb22dd2569ae21c08923ae1a9dad", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 245, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 592, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\"},\"name\":\"Nginx logs\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations" + }, + "response": { + "bodySize": 342, + "content": { + "mimeType": "application/json", + "size": 342, + "text": "{\"data\":{\"id\":\"c475e180-758a-4503-a2ab-3ff1779c738a\",\"attributes\":{\"name\":\"Nginx logs\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 712, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:52.122Z", + "time": 692 + }, + { + "_id": "81138bc4bf30067440ba1dbac6d5252c", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 0, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "*/*" + } + ], + "headersSize": 565, + "httpVersion": "HTTP/1.1", + "method": "DELETE", + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/c475e180-758a-4503-a2ab-3ff1779c738a" + }, + "response": { + "bodySize": 0, + "content": { + "mimeType": "text/html; charset=utf-8", + "size": 0 + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "text/html; charset=utf-8" + } + ], + "headersSize": 699, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 204, + "statusText": "No Content" + }, + "startedDateTime": "2026-03-25T16:23:52.819Z", + "time": 355 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-attributes-preserves-the-absent-sourcetype-returns-O_3882498518/frozen.json b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-attributes-preserves-the-absent-sourcetype-returns-O_3882498518/frozen.json new file mode 100644 index 000000000000..1d52ad976e59 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-attributes-preserves-the-absent-sourcetype-returns-O_3882498518/frozen.json @@ -0,0 +1 @@ +"2026-03-25T16:23:55.981Z" diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-attributes-preserves-the-absent-sourcetype-returns-O_3882498518/recording.har b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-attributes-preserves-the-absent-sourcetype-returns-O_3882498518/recording.har new file mode 100644 index 000000000000..a26cee9fb6a0 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-attributes-preserves-the-absent-sourcetype-returns-O_3882498518/recording.har @@ -0,0 +1,162 @@ +{ + "log": { + "_recordingName": "Logs Custom Destinations/Update a Splunk custom destination's attributes preserves the absent sourcetype returns \"OK\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "5582114d01bc519a080e4ff4ad1ac1aa", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 350, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 593, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\"},\"name\":\"Test-Update_a_Splunk_custom_destination_s_attributes_preserves_the_absent_sourcetype_returns_OK_response-1774455835\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations" + }, + "response": { + "bodySize": 447, + "content": { + "mimeType": "application/json", + "size": 447, + "text": "{\"data\":{\"id\":\"9ac57fd5-857f-4082-badc-463ecd1e990d\",\"attributes\":{\"name\":\"Test-Update_a_Splunk_custom_destination_s_attributes_preserves_the_absent_sourcetype_returns_OK_response-1774455835\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 712, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:55.983Z", + "time": 489 + }, + { + "_id": "2461a2ccd618f242e3742306f71c00ae", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 127, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 631, + "httpVersion": "HTTP/1.1", + "method": "PATCH", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"name\":\"Nginx logs (Updated)\"},\"id\":\"9ac57fd5-857f-4082-badc-463ecd1e990d\",\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/9ac57fd5-857f-4082-badc-463ecd1e990d" + }, + "response": { + "bodySize": 352, + "content": { + "mimeType": "application/json", + "size": 352, + "text": "{\"data\":{\"id\":\"9ac57fd5-857f-4082-badc-463ecd1e990d\",\"attributes\":{\"name\":\"Nginx logs (Updated)\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 712, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:56.477Z", + "time": 548 + }, + { + "_id": "39d0bda98ebe1408ef7da64cb7fe9b22", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 0, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "*/*" + } + ], + "headersSize": 566, + "httpVersion": "HTTP/1.1", + "method": "DELETE", + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/9ac57fd5-857f-4082-badc-463ecd1e990d" + }, + "response": { + "bodySize": 0, + "content": { + "mimeType": "text/html; charset=utf-8", + "size": 0 + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "text/html; charset=utf-8" + } + ], + "headersSize": 699, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 204, + "statusText": "No Content" + }, + "startedDateTime": "2026-03-25T16:23:57.030Z", + "time": 2051 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-null-sourcetype-returns-OK_3233447697/frozen.json b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-null-sourcetype-returns-OK_3233447697/frozen.json new file mode 100644 index 000000000000..e2c639b2914c --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-null-sourcetype-returns-OK_3233447697/frozen.json @@ -0,0 +1 @@ +"2026-03-25T16:23:59.087Z" diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-null-sourcetype-returns-OK_3233447697/recording.har b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-null-sourcetype-returns-OK_3233447697/recording.har new file mode 100644 index 000000000000..4e62287bf0d8 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-null-sourcetype-returns-OK_3233447697/recording.har @@ -0,0 +1,162 @@ +{ + "log": { + "_recordingName": "Logs Custom Destinations/Update a Splunk custom destination's destination preserves the null sourcetype returns \"OK\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "ea2caff932172082ff6f1a9b63bdeab5", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 367, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 591, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":null,\"type\":\"splunk_hec\"},\"name\":\"Test-Update_a_Splunk_custom_destination_s_destination_preserves_the_null_sourcetype_returns_OK_response-1774455839\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations" + }, + "response": { + "bodySize": 464, + "content": { + "mimeType": "application/json", + "size": 464, + "text": "{\"data\":{\"id\":\"1cf9102b-169d-4a5c-a82b-aa5b3a12d6c5\",\"attributes\":{\"name\":\"Test-Update_a_Splunk_custom_destination_s_destination_preserves_the_null_sourcetype_returns_OK_response-1774455839\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":null},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 712, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:59.091Z", + "time": 592 + }, + { + "_id": "cf03b4ace14ea01abbc97be9f47fca0e", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 217, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 629, + "httpVersion": "HTTP/1.1", + "method": "PATCH", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://updated-example.com\",\"type\":\"splunk_hec\"}},\"id\":\"1cf9102b-169d-4a5c-a82b-aa5b3a12d6c5\",\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/1cf9102b-169d-4a5c-a82b-aa5b3a12d6c5" + }, + "response": { + "bodySize": 472, + "content": { + "mimeType": "application/json", + "size": 472, + "text": "{\"data\":{\"id\":\"1cf9102b-169d-4a5c-a82b-aa5b3a12d6c5\",\"attributes\":{\"name\":\"Test-Update_a_Splunk_custom_destination_s_destination_preserves_the_null_sourcetype_returns_OK_response-1774455839\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://updated-example.com\",\"type\":\"splunk_hec\",\"sourcetype\":null},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 712, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:59.688Z", + "time": 400 + }, + { + "_id": "98dc633b8c6103f632626f3aa69d1665", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 0, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "*/*" + } + ], + "headersSize": 564, + "httpVersion": "HTTP/1.1", + "method": "DELETE", + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/1cf9102b-169d-4a5c-a82b-aa5b3a12d6c5" + }, + "response": { + "bodySize": 0, + "content": { + "mimeType": "text/html; charset=utf-8", + "size": 0 + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "text/html; charset=utf-8" + } + ], + "headersSize": 700, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 204, + "statusText": "No Content" + }, + "startedDateTime": "2026-03-25T16:24:00.094Z", + "time": 397 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-sourcetype-returns-OK-resp_2260707336/frozen.json b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-sourcetype-returns-OK-resp_2260707336/frozen.json new file mode 100644 index 000000000000..1f1f22598312 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-sourcetype-returns-OK-resp_2260707336/frozen.json @@ -0,0 +1 @@ +"2026-03-25T16:24:00.500Z" diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-sourcetype-returns-OK-resp_2260707336/recording.har b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-sourcetype-returns-OK-resp_2260707336/recording.har new file mode 100644 index 000000000000..9ac1da5c236a --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-s-destination-preserves-the-sourcetype-returns-OK-resp_2260707336/recording.har @@ -0,0 +1,162 @@ +{ + "log": { + "_recordingName": "Logs Custom Destinations/Update a Splunk custom destination's destination preserves the sourcetype returns \"OK\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "e54a3c94e361a1bd4cd5a01660135f4d", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 373, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 593, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":\"my-sourcetype\",\"type\":\"splunk_hec\"},\"name\":\"Test-Update_a_Splunk_custom_destination_s_destination_preserves_the_sourcetype_returns_OK_response-1774455840\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations" + }, + "response": { + "bodySize": 470, + "content": { + "mimeType": "application/json", + "size": 470, + "text": "{\"data\":{\"id\":\"fa416048-c8e1-4b5a-a3e1-b6c2538d5903\",\"attributes\":{\"name\":\"Test-Update_a_Splunk_custom_destination_s_destination_preserves_the_sourcetype_returns_OK_response-1774455840\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":\"my-sourcetype\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 713, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:24:00.510Z", + "time": 419 + }, + { + "_id": "dcc8ffdeb2dcf9f5e296945e1be56738", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 217, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 631, + "httpVersion": "HTTP/1.1", + "method": "PATCH", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://updated-example.com\",\"type\":\"splunk_hec\"}},\"id\":\"fa416048-c8e1-4b5a-a3e1-b6c2538d5903\",\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/fa416048-c8e1-4b5a-a3e1-b6c2538d5903" + }, + "response": { + "bodySize": 478, + "content": { + "mimeType": "application/json", + "size": 478, + "text": "{\"data\":{\"id\":\"fa416048-c8e1-4b5a-a3e1-b6c2538d5903\",\"attributes\":{\"name\":\"Test-Update_a_Splunk_custom_destination_s_destination_preserves_the_sourcetype_returns_OK_response-1774455840\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://updated-example.com\",\"type\":\"splunk_hec\",\"sourcetype\":\"my-sourcetype\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 713, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:24:00.934Z", + "time": 430 + }, + { + "_id": "eaf8a3abdbb47d9ecd56f7daa2ec6bbe", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 0, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "*/*" + } + ], + "headersSize": 566, + "httpVersion": "HTTP/1.1", + "method": "DELETE", + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/fa416048-c8e1-4b5a-a3e1-b6c2538d5903" + }, + "response": { + "bodySize": 0, + "content": { + "mimeType": "text/html; charset=utf-8", + "size": 0 + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "text/html; charset=utf-8" + } + ], + "headersSize": 700, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 204, + "statusText": "No Content" + }, + "startedDateTime": "2026-03-25T16:24:01.371Z", + "time": 380 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_1233829200/frozen.json b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_1233829200/frozen.json new file mode 100644 index 000000000000..6bd4cbca6043 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_1233829200/frozen.json @@ -0,0 +1 @@ +"2026-03-25T16:23:53.183Z" diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_1233829200/recording.har b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_1233829200/recording.har new file mode 100644 index 000000000000..eee42236310b --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_1233829200/recording.har @@ -0,0 +1,162 @@ +{ + "log": { + "_recordingName": "Logs Custom Destinations/Update a Splunk custom destination with a null sourcetype returns \"OK\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "47eb4467823d62ef9092b78c74c31ec6", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 357, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 593, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":\"my-sourcetype\",\"type\":\"splunk_hec\"},\"name\":\"Test-Update_a_Splunk_custom_destination_with_a_null_sourcetype_returns_OK_response-1774455833\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations" + }, + "response": { + "bodySize": 454, + "content": { + "mimeType": "application/json", + "size": 454, + "text": "{\"data\":{\"id\":\"f718e9ba-6676-46f9-ae62-1e63b0348dbc\",\"attributes\":{\"name\":\"Test-Update_a_Splunk_custom_destination_with_a_null_sourcetype_returns_OK_response-1774455833\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":\"my-sourcetype\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 712, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:53.192Z", + "time": 470 + }, + { + "_id": "e3a14e2bf8e75e6e87122075385db725", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 227, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 631, + "httpVersion": "HTTP/1.1", + "method": "PATCH", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":null,\"type\":\"splunk_hec\"}},\"id\":\"f718e9ba-6676-46f9-ae62-1e63b0348dbc\",\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/f718e9ba-6676-46f9-ae62-1e63b0348dbc" + }, + "response": { + "bodySize": 443, + "content": { + "mimeType": "application/json", + "size": 443, + "text": "{\"data\":{\"id\":\"f718e9ba-6676-46f9-ae62-1e63b0348dbc\",\"attributes\":{\"name\":\"Test-Update_a_Splunk_custom_destination_with_a_null_sourcetype_returns_OK_response-1774455833\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":null},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 712, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:53.666Z", + "time": 472 + }, + { + "_id": "186dd21c72dccdefb6658d0376bc32db", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 0, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "*/*" + } + ], + "headersSize": 566, + "httpVersion": "HTTP/1.1", + "method": "DELETE", + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/f718e9ba-6676-46f9-ae62-1e63b0348dbc" + }, + "response": { + "bodySize": 0, + "content": { + "mimeType": "text/html; charset=utf-8", + "size": 0 + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "text/html; charset=utf-8" + } + ], + "headersSize": 699, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 204, + "statusText": "No Content" + }, + "startedDateTime": "2026-03-25T16:23:54.144Z", + "time": 560 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3853409135/frozen.json b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3853409135/frozen.json new file mode 100644 index 000000000000..0e213c5abfd8 --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3853409135/frozen.json @@ -0,0 +1 @@ +"2026-03-25T16:23:54.709Z" diff --git a/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3853409135/recording.har b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3853409135/recording.har new file mode 100644 index 000000000000..71fe1f8b563b --- /dev/null +++ b/cassettes/v2/Logs-Custom-Destinations_2771509030/Update-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3853409135/recording.har @@ -0,0 +1,162 @@ +{ + "log": { + "_recordingName": "Logs Custom Destinations/Update a Splunk custom destination with a sourcetype returns \"OK\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "8be1f4d58cdf9c064a830f1ef7840528", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 323, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 592, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\"},\"name\":\"Test-Update_a_Splunk_custom_destination_with_a_sourcetype_returns_OK_response-1774455834\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations" + }, + "response": { + "bodySize": 420, + "content": { + "mimeType": "application/json", + "size": 420, + "text": "{\"data\":{\"id\":\"12f30686-f946-4eb1-8988-643d55ad0cb9\",\"attributes\":{\"name\":\"Test-Update_a_Splunk_custom_destination_with_a_sourcetype_returns_OK_response-1774455834\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 712, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:54.711Z", + "time": 487 + }, + { + "_id": "032ed59524d2522bba6fed95c56d2705", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 239, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 630, + "httpVersion": "HTTP/1.1", + "method": "PATCH", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"data\":{\"attributes\":{\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":\"new-sourcetype\",\"type\":\"splunk_hec\"}},\"id\":\"12f30686-f946-4eb1-8988-643d55ad0cb9\",\"type\":\"custom_destination\"}}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/12f30686-f946-4eb1-8988-643d55ad0cb9" + }, + "response": { + "bodySize": 450, + "content": { + "mimeType": "application/json", + "size": 450, + "text": "{\"data\":{\"id\":\"12f30686-f946-4eb1-8988-643d55ad0cb9\",\"attributes\":{\"name\":\"Test-Update_a_Splunk_custom_destination_with_a_sourcetype_returns_OK_response-1774455834\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":\"new-sourcetype\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/json" + } + ], + "headersSize": 712, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-03-25T16:23:55.201Z", + "time": 368 + }, + { + "_id": "29ec478532925089c837cc56301f0e58", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 0, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "*/*" + } + ], + "headersSize": 565, + "httpVersion": "HTTP/1.1", + "method": "DELETE", + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/12f30686-f946-4eb1-8988-643d55ad0cb9" + }, + "response": { + "bodySize": 0, + "content": { + "mimeType": "text/html; charset=utf-8", + "size": 0 + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "text/html; charset=utf-8" + } + ], + "headersSize": 699, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 204, + "statusText": "No Content" + }, + "startedDateTime": "2026-03-25T16:23:55.573Z", + "time": 404 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/features/v2/given.json b/features/v2/given.json index 8413be265af8..11013dcb01ed 100644 --- a/features/v2/given.json +++ b/features/v2/given.json @@ -737,6 +737,42 @@ "tag": "Logs Custom Destinations", "operationId": "CreateLogsCustomDestination" }, + { + "parameters": [ + { + "name": "body", + "value": "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"query\": \"source:nginx\",\n \"enabled\": false,\n \"forwarder_destination\": {\n \"type\": \"splunk_hec\",\n \"endpoint\": \"https://example.com\",\n \"access_token\": \"my-access-token\"\n },\n \"forward_tags\": false\n },\n \"type\": \"custom_destination\"\n }\n}" + } + ], + "step": "there is a valid \"custom_destination_splunk\" in the system", + "key": "custom_destination_splunk", + "tag": "Logs Custom Destinations", + "operationId": "CreateLogsCustomDestination" + }, + { + "parameters": [ + { + "name": "body", + "value": "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"query\": \"source:nginx\",\n \"enabled\": false,\n \"forwarder_destination\": {\n \"type\": \"splunk_hec\",\n \"endpoint\": \"https://example.com\",\n \"access_token\": \"my-access-token\",\n \"sourcetype\": null\n },\n \"forward_tags\": false\n },\n \"type\": \"custom_destination\"\n }\n}" + } + ], + "step": "there is a valid \"custom_destination_splunk_with_null_sourcetype\" in the system", + "key": "custom_destination_splunk_with_null_sourcetype", + "tag": "Logs Custom Destinations", + "operationId": "CreateLogsCustomDestination" + }, + { + "parameters": [ + { + "name": "body", + "value": "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"query\": \"source:nginx\",\n \"enabled\": false,\n \"forwarder_destination\": {\n \"type\": \"splunk_hec\",\n \"endpoint\": \"https://example.com\",\n \"access_token\": \"my-access-token\",\n \"sourcetype\": \"my-sourcetype\"\n },\n \"forward_tags\": false\n },\n \"type\": \"custom_destination\"\n }\n}" + } + ], + "step": "there is a valid \"custom_destination_splunk_with_sourcetype\" in the system", + "key": "custom_destination_splunk_with_sourcetype", + "tag": "Logs Custom Destinations", + "operationId": "CreateLogsCustomDestination" + }, { "parameters": [ { diff --git a/features/v2/logs_custom_destinations.feature b/features/v2/logs_custom_destinations.feature index 44b85404852f..e9aa22909977 100644 --- a/features/v2/logs_custom_destinations.feature +++ b/features/v2/logs_custom_destinations.feature @@ -93,6 +93,7 @@ Feature: Logs Custom Destinations And the response "data.attributes.forwarder_destination.type" is equal to "splunk_hec" And the response "data.attributes.forwarder_destination.endpoint" is equal to "https://example.com" And the response "data.attributes.forwarder_destination" does not have field "access_token" + And the response "data.attributes.forwarder_destination" does not have field "sourcetype" And the response "data.attributes.enabled" is false And the response "data.attributes.forward_tags" is false And the response "data.attributes.forward_tags_restriction_list" has length 2 @@ -100,6 +101,58 @@ Feature: Logs Custom Destinations And the response "data.attributes.forward_tags_restriction_list" array contains value "host" And the response "data.attributes.forward_tags_restriction_list_type" is equal to "ALLOW_LIST" + @team:DataDog/logs-backend @team:DataDog/logs-forwarding + Scenario: Create a Splunk custom destination with a null sourcetype returns "OK" response + Given new "CreateLogsCustomDestination" request + And body with value {"data": {"attributes": {"enabled": false, "forward_tags": false, "forwarder_destination": {"access_token": "my-access-token", "endpoint": "https://example.com", "type": "splunk_hec", "sourcetype": null}, "name": "Nginx logs", "query": "source:nginx"}, "type": "custom_destination"}} + When the request is sent + Then the response status is 200 OK + And the response "data.type" is equal to "custom_destination" + And the response "data" has field "id" + And the response "data.attributes.forwarder_destination.type" is equal to "splunk_hec" + And the response "data.attributes.forwarder_destination.endpoint" is equal to "https://example.com" + And the response "data.attributes.forwarder_destination" does not have field "access_token" + And the response "data.attributes.forwarder_destination.sourcetype" is equal to null + + @team:DataDog/logs-backend @team:DataDog/logs-forwarding + Scenario: Create a Splunk custom destination with a sourcetype returns "OK" response + Given new "CreateLogsCustomDestination" request + And body with value {"data": {"attributes": {"enabled": false, "forward_tags": false, "forwarder_destination": {"access_token": "my-access-token", "endpoint": "https://example.com", "type": "splunk_hec", "sourcetype": "my-sourcetype"}, "name": "Nginx logs", "query": "source:nginx"}, "type": "custom_destination"}} + When the request is sent + Then the response status is 200 OK + And the response "data.type" is equal to "custom_destination" + And the response "data" has field "id" + And the response "data.attributes.forwarder_destination.type" is equal to "splunk_hec" + And the response "data.attributes.forwarder_destination.endpoint" is equal to "https://example.com" + And the response "data.attributes.forwarder_destination" does not have field "access_token" + And the response "data.attributes.forwarder_destination.sourcetype" is equal to "my-sourcetype" + + @team:DataDog/logs-backend @team:DataDog/logs-forwarding + Scenario: Create a Splunk custom destination with an empty string sourcetype returns "OK" response + Given new "CreateLogsCustomDestination" request + And body with value {"data": {"attributes": {"enabled": false, "forward_tags": false, "forwarder_destination": {"access_token": "my-access-token", "endpoint": "https://example.com", "type": "splunk_hec", "sourcetype": ""}, "name": "Nginx logs", "query": "source:nginx"}, "type": "custom_destination"}} + When the request is sent + Then the response status is 200 OK + And the response "data.type" is equal to "custom_destination" + And the response "data" has field "id" + And the response "data.attributes.forwarder_destination.type" is equal to "splunk_hec" + And the response "data.attributes.forwarder_destination.endpoint" is equal to "https://example.com" + And the response "data.attributes.forwarder_destination" does not have field "access_token" + And the response "data.attributes.forwarder_destination.sourcetype" is equal to "" + + @team:DataDog/logs-backend @team:DataDog/logs-forwarding + Scenario: Create a Splunk custom destination without a sourcetype returns "OK" response + Given new "CreateLogsCustomDestination" request + And body with value {"data": {"attributes": {"enabled": false, "forward_tags": false, "forwarder_destination": {"access_token": "my-access-token", "endpoint": "https://example.com", "type": "splunk_hec"}, "name": "Nginx logs", "query": "source:nginx"}, "type": "custom_destination"}} + When the request is sent + Then the response status is 200 OK + And the response "data.type" is equal to "custom_destination" + And the response "data" has field "id" + And the response "data.attributes.forwarder_destination.type" is equal to "splunk_hec" + And the response "data.attributes.forwarder_destination.endpoint" is equal to "https://example.com" + And the response "data.attributes.forwarder_destination" does not have field "access_token" + And the response "data.attributes.forwarder_destination" does not have field "sourcetype" + @skip-java @skip-python @skip-rust @skip-typescript @team:DataDog/logs-backend @team:DataDog/logs-forwarding Scenario: Create a custom destination returns "Bad Request" response Given new "CreateLogsCustomDestination" request @@ -219,6 +272,80 @@ Feature: Logs Custom Destinations And the response "data" has item with field "attributes.forward_tags" with value false And the response "data" has item with field "attributes.forward_tags_restriction_list_type" with value "{{ custom_destination.data.attributes.forward_tags_restriction_list_type }}" + @team:DataDog/logs-backend @team:DataDog/logs-forwarding + Scenario: Update a Splunk custom destination with a null sourcetype returns "OK" response + Given new "UpdateLogsCustomDestination" request + And there is a valid "custom_destination_splunk_with_sourcetype" in the system + And request contains "custom_destination_id" parameter from "custom_destination_splunk_with_sourcetype.data.id" + And body with value {"data": {"attributes": {"forwarder_destination": {"type": "splunk_hec", "endpoint": "https://example.com", "access_token": "my-access-token", "sourcetype": null}}, "type": "custom_destination", "id": "{{ custom_destination_splunk_with_sourcetype.data.id }}"}} + When the request is sent + Then the response status is 200 OK + And the response "data.type" is equal to "custom_destination" + And the response "data.id" is equal to "{{ custom_destination_splunk_with_sourcetype.data.id }}" + And the response "data.attributes.forwarder_destination.type" is equal to "splunk_hec" + And the response "data.attributes.forwarder_destination.endpoint" is equal to "https://example.com" + And the response "data.attributes.forwarder_destination" does not have field "access_token" + And the response "data.attributes.forwarder_destination.sourcetype" is equal to null + + @team:DataDog/logs-backend @team:DataDog/logs-forwarding + Scenario: Update a Splunk custom destination with a sourcetype returns "OK" response + Given new "UpdateLogsCustomDestination" request + And there is a valid "custom_destination_splunk" in the system + And request contains "custom_destination_id" parameter from "custom_destination_splunk.data.id" + And body with value {"data": {"attributes": {"forwarder_destination": {"type": "splunk_hec", "endpoint": "https://example.com", "access_token": "my-access-token", "sourcetype": "new-sourcetype"}}, "type": "custom_destination", "id": "{{ custom_destination_splunk.data.id }}"}} + When the request is sent + Then the response status is 200 OK + And the response "data.type" is equal to "custom_destination" + And the response "data.id" is equal to "{{ custom_destination_splunk.data.id }}" + And the response "data.attributes.forwarder_destination.type" is equal to "splunk_hec" + And the response "data.attributes.forwarder_destination.endpoint" is equal to "https://example.com" + And the response "data.attributes.forwarder_destination" does not have field "access_token" + And the response "data.attributes.forwarder_destination.sourcetype" is equal to "new-sourcetype" + + @team:DataDog/logs-backend @team:DataDog/logs-forwarding + Scenario: Update a Splunk custom destination's attributes preserves the absent sourcetype returns "OK" response + Given new "UpdateLogsCustomDestination" request + And there is a valid "custom_destination_splunk" in the system + And request contains "custom_destination_id" parameter from "custom_destination_splunk.data.id" + And body with value {"data": {"attributes": {"name": "Nginx logs (Updated)"}, "type": "custom_destination", "id": "{{ custom_destination_splunk.data.id }}"}} + When the request is sent + Then the response status is 200 OK + And the response "data.type" is equal to "custom_destination" + And the response "data.id" is equal to "{{ custom_destination_splunk.data.id }}" + And the response "data.attributes.name" is equal to "Nginx logs (Updated)" + And the response "data.attributes.forwarder_destination.type" is equal to "splunk_hec" + And the response "data.attributes.forwarder_destination" does not have field "sourcetype" + + @team:DataDog/logs-backend @team:DataDog/logs-forwarding + Scenario: Update a Splunk custom destination's destination preserves the null sourcetype returns "OK" response + Given new "UpdateLogsCustomDestination" request + And there is a valid "custom_destination_splunk_with_null_sourcetype" in the system + And request contains "custom_destination_id" parameter from "custom_destination_splunk_with_null_sourcetype.data.id" + And body with value {"data": {"attributes": {"forwarder_destination": {"type": "splunk_hec", "endpoint": "https://updated-example.com", "access_token": "my-access-token"}}, "type": "custom_destination", "id": "{{ custom_destination_splunk_with_null_sourcetype.data.id }}"}} + When the request is sent + Then the response status is 200 OK + And the response "data.type" is equal to "custom_destination" + And the response "data.id" is equal to "{{ custom_destination_splunk_with_null_sourcetype.data.id }}" + And the response "data.attributes.forwarder_destination.type" is equal to "splunk_hec" + And the response "data.attributes.forwarder_destination.endpoint" is equal to "https://updated-example.com" + And the response "data.attributes.forwarder_destination" does not have field "access_token" + And the response "data.attributes.forwarder_destination.sourcetype" is equal to null + + @team:DataDog/logs-backend @team:DataDog/logs-forwarding + Scenario: Update a Splunk custom destination's destination preserves the sourcetype returns "OK" response + Given new "UpdateLogsCustomDestination" request + And there is a valid "custom_destination_splunk_with_sourcetype" in the system + And request contains "custom_destination_id" parameter from "custom_destination_splunk_with_sourcetype.data.id" + And body with value {"data": {"attributes": {"forwarder_destination": {"type": "splunk_hec", "endpoint": "https://updated-example.com", "access_token": "my-access-token"}}, "type": "custom_destination", "id": "{{ custom_destination_splunk_with_sourcetype.data.id }}"}} + When the request is sent + Then the response status is 200 OK + And the response "data.type" is equal to "custom_destination" + And the response "data.id" is equal to "{{ custom_destination_splunk_with_sourcetype.data.id }}" + And the response "data.attributes.forwarder_destination.type" is equal to "splunk_hec" + And the response "data.attributes.forwarder_destination.endpoint" is equal to "https://updated-example.com" + And the response "data.attributes.forwarder_destination" does not have field "access_token" + And the response "data.attributes.forwarder_destination.sourcetype" is equal to "my-sourcetype" + @team:DataDog/logs-backend @team:DataDog/logs-forwarding Scenario: Update a custom destination returns "Bad Request" response Given new "UpdateLogsCustomDestination" request diff --git a/services/logs_custom_destinations/src/v2/models/CustomDestinationForwardDestinationSplunk.ts b/services/logs_custom_destinations/src/v2/models/CustomDestinationForwardDestinationSplunk.ts index fc3316d72011..fabca8b508f5 100644 --- a/services/logs_custom_destinations/src/v2/models/CustomDestinationForwardDestinationSplunk.ts +++ b/services/logs_custom_destinations/src/v2/models/CustomDestinationForwardDestinationSplunk.ts @@ -15,6 +15,14 @@ export class CustomDestinationForwardDestinationSplunk { * Must have HTTPS scheme and forwarding back to Datadog is not allowed. */ "endpoint": string; + /** + * The Splunk sourcetype for the events sent to this Splunk destination. + * + * If absent, the default sourcetype `_json` is used. If set to null, the `sourcetype` + * field is omitted from the Splunk HEC payload entirely. Otherwise, the provided string + * value is used as the sourcetype. + */ + "sourcetype"?: string; /** * Type of the Splunk HTTP Event Collector (HEC) destination. */ @@ -44,6 +52,10 @@ export class CustomDestinationForwardDestinationSplunk { type: "string", required: true, }, + sourcetype: { + baseName: "sourcetype", + type: "string", + }, type: { baseName: "type", type: "CustomDestinationForwardDestinationSplunkType", diff --git a/services/logs_custom_destinations/src/v2/models/CustomDestinationResponseForwardDestinationSplunk.ts b/services/logs_custom_destinations/src/v2/models/CustomDestinationResponseForwardDestinationSplunk.ts index 2bb6c5588ae9..a5fe1564edda 100644 --- a/services/logs_custom_destinations/src/v2/models/CustomDestinationResponseForwardDestinationSplunk.ts +++ b/services/logs_custom_destinations/src/v2/models/CustomDestinationResponseForwardDestinationSplunk.ts @@ -11,6 +11,14 @@ export class CustomDestinationResponseForwardDestinationSplunk { * Must have HTTPS scheme and forwarding back to Datadog is not allowed. */ "endpoint": string; + /** + * The Splunk sourcetype for the events sent to this Splunk destination. + * + * If absent, the default sourcetype `_json` is used. If set to null, the `sourcetype` + * field is omitted from the Splunk HEC payload entirely. Otherwise, the provided string + * value is used as the sourcetype. + */ + "sourcetype"?: string; /** * Type of the Splunk HTTP Event Collector (HEC) destination. */ @@ -35,6 +43,10 @@ export class CustomDestinationResponseForwardDestinationSplunk { type: "string", required: true, }, + sourcetype: { + baseName: "sourcetype", + type: "string", + }, type: { baseName: "type", type: "CustomDestinationResponseForwardDestinationSplunkType",