From 5cc9e03d054728b8f97d9214aa58910aa493c502 Mon Sep 17 00:00:00 2001
From: Antoine Toulme <antoine@lunar-ocean.com>
Date: Wed, 15 May 2024 20:00:51 -0700
Subject: [PATCH] [receiver/splunk_hec] Fix single metric value parsing
 (#33085)

**Description:**
 Fix single metric value parsing

**Link to tracking Issue:**
Fixes #33084
---
 .chloggen/fix_hec_single_value.yaml | 27 +++++++++++++++++++++++++++
 internal/splunk/common.go           |  8 ++++++--
 internal/splunk/common_test.go      | 10 ++++++++++
 3 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 .chloggen/fix_hec_single_value.yaml

diff --git a/.chloggen/fix_hec_single_value.yaml b/.chloggen/fix_hec_single_value.yaml
new file mode 100644
index 000000000000..71eefe372c49
--- /dev/null
+++ b/.chloggen/fix_hec_single_value.yaml
@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: splunkhecreceiver
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Fix single metric value parsing
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [33084]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []
diff --git a/internal/splunk/common.go b/internal/splunk/common.go
index a9ad5088ebb2..a98d064b6513 100644
--- a/internal/splunk/common.go
+++ b/internal/splunk/common.go
@@ -51,12 +51,16 @@ type Event struct {
 }
 
 // IsMetric returns true if the Splunk event is a metric.
-func (e Event) IsMetric() bool {
+func (e *Event) IsMetric() bool {
 	return e.Event == HecEventMetricType || (e.Event == nil && len(e.GetMetricValues()) > 0)
 }
 
 // GetMetricValues extracts metric key value pairs from a Splunk HEC metric.
-func (e Event) GetMetricValues() map[string]any {
+func (e *Event) GetMetricValues() map[string]any {
+	if v, ok := e.Fields["metric_name"]; ok {
+		return map[string]any{v.(string): e.Fields["_value"]}
+	}
+
 	values := map[string]any{}
 	for k, v := range e.Fields {
 		if strings.HasPrefix(k, "metric_name:") {
diff --git a/internal/splunk/common_test.go b/internal/splunk/common_test.go
index 621ae844a1f9..5ec597153351 100644
--- a/internal/splunk/common_test.go
+++ b/internal/splunk/common_test.go
@@ -22,6 +22,16 @@ func TestGetValues(t *testing.T) {
 	assert.Equal(t, map[string]any{"foo": "bar", "foo2": "foobar"}, metric.GetMetricValues())
 }
 
+func TestSingleValue(t *testing.T) {
+	metric := Event{
+		Fields: map[string]any{
+			"metric_name": "foo",
+			"_value":      123,
+		},
+	}
+	assert.Equal(t, map[string]any{"foo": 123}, metric.GetMetricValues())
+}
+
 func TestIsMetric(t *testing.T) {
 	ev := Event{
 		Event: map[string]any{},