[internal/splunk] Splunk metric names should be validated via regex

Author: spiffyy99

internal/splunk/common.go

@@ -5,6 +5,7 @@ package splunk // import "github.com/open-telemetry/opentelemetry-collector-cont
 
 import (
 	"encoding/json"
+	"regexp"
 	"strconv"
 	"strings"
 )
@@ -31,6 +32,14 @@ const (
 	DefaultRawPath     = "/services/collector/raw"
 	DefaultHealthPath  = "/services/collector/health"
 	DefaultAckPath     = "/services/collector/ack"
+
+	// https://docs.splunk.com/Documentation/Splunk/9.2.1/Metrics/Overview#What_is_a_metric_data_point.3F
+	// metric name can contain letters, numbers, underscore, dot or colon. cannot start with number or underscore, or contain metric_name
+	metricNamePattern = "^metric_name:([A-Za-z\\.:][A-Za-z0-9_\\.:]*)$"
+)
+
+var (
+	metricNameRegexp = regexp.MustCompile(metricNamePattern)
 )
 
 // AccessTokenPassthroughConfig configures passing through access tokens.
@@ -55,6 +64,15 @@ func (e *Event) IsMetric() bool {
 	return e.Event == HecEventMetricType || (e.Event == nil && len(e.GetMetricValues()) > 0)
 }
 
+// checks if the field name matches the requirements for a metric datapoint field,
+// and returns the metric name and a bool indicating whether the field is a metric.
+func getMetricNameFromField(fieldName string) (string, bool) {
+	if matches := metricNameRegexp.FindStringSubmatch(fieldName); len(matches) > 1 {
+		return matches[1], !strings.Contains(matches[1], "metric_name")
+	}
+	return "", false
+}
+
 // GetMetricValues extracts metric key value pairs from a Splunk HEC metric.
 func (e *Event) GetMetricValues() map[string]any {
 	if v, ok := e.Fields["metric_name"]; ok {
@@ -63,8 +81,11 @@ func (e *Event) GetMetricValues() map[string]any {
 
 	values := map[string]any{}
 	for k, v := range e.Fields {
-		if strings.HasPrefix(k, "metric_name:") {
-			values[k[12:]] = v
+		// only consider metric name if it fits regex criteria.
+		// use matches[1] since first element contains entire string.
+		// first subgroup will be the actual metric name.
+		if metricName, ok := getMetricNameFromField(k); ok {
+			values[metricName] = v
 		}
 	}
 	return values

internal/splunk/common_test.go

@@ -16,10 +16,21 @@ func TestGetValues(t *testing.T) {
 		Fields: map[string]any{},
 	}
 	assert.Equal(t, map[string]any{}, metric.GetMetricValues())
+	metric.Fields["metric_name:x"] = "y"
+	assert.Equal(t, map[string]any{"x": "y"}, metric.GetMetricValues())
 	metric.Fields["metric_name:foo"] = "bar"
-	assert.Equal(t, map[string]any{"foo": "bar"}, metric.GetMetricValues())
+	assert.Equal(t, map[string]any{"x": "y", "foo": "bar"}, metric.GetMetricValues())
 	metric.Fields["metric_name:foo2"] = "foobar"
-	assert.Equal(t, map[string]any{"foo": "bar", "foo2": "foobar"}, metric.GetMetricValues())
+	assert.Equal(t, map[string]any{"x": "y", "foo": "bar", "foo2": "foobar"}, metric.GetMetricValues())
+	metric.Fields["metric_name:foo:123_456.Bar"] = "quux"
+	assert.Equal(t, map[string]any{"x": "y", "foo": "bar", "foo2": "foobar", "foo:123_456.Bar": "quux"}, metric.GetMetricValues())
+	// fields that aren't allowed
+	metric.Fields["metric_name:foo bar"] = "baz"             // contains space
+	metric.Fields["metric_name:foo?"] = "baz"                // illegal character
+	metric.Fields["metric_name:1stfoo"] = "baz"              // starts with number
+	metric.Fields["metric_name:_foo"] = "baz"                // starts with underscore
+	metric.Fields["metric_name:foo_metric_name:bar"] = "baz" // name contains "metric_name"
+	assert.Equal(t, map[string]any{"x": "y", "foo": "bar", "foo2": "foobar", "foo:123_456.Bar": "quux"}, metric.GetMetricValues())
 }
 
 func TestSingleValue(t *testing.T) {