private static SplunkMessage EventToSplunkMessage(string eventData, EventHubMessage eventHubMessage) =>
new SplunkMessage()
{
SourceType = "_json",
Source = eventHubMessage.GetSource(),
Time = (DateTime.Parse(eventHubMessage.Time).Subtract(zeroTime)).TotalMilliseconds / 1000,
Event = new JRaw(eventData)
};
private static bool ValidateEventHubMessage(string json, EventHubMessage eventHubMessage)
{
if ((string.IsNullOrWhiteSpace(eventHubMessage.App) && string.IsNullOrWhiteSpace(eventHubMessage.Source)) || string.IsNullOrWhiteSpace(eventHubMessage.Time))
{
exceptions.Add(new Exception($"Skipping Event Hub event missing app/source and/or time properties: {json}"));
return(false);
}
return(true);
}