Is it possible to template a boolean value in a sink configuration

[tbenade]

Hi,

Currently trying to set the value of auto_extract_timestamp which expects a boolean in the Splunk Hec sink based on a boolean value in the event. Eg '{{ .config.logs.auto_extract_timestamp }}'.

This fails validation as the template is parsed and expressed as a string. validate fails validation with x invalid type: string "{{ .config.logs.auto_extract_timestamp }}", expected a boolean

So I'm wondering if there any other way I could set this value in the configuration based on the value in the event field?

Thanks

[jszwedko]

Unfortunately that field isn't templatable currently. It'd be a bit tricky to make templatable since Splunk expects that parameter as a URL parameter and so requests would need to be partitioned across them. We'd be open to seeing a PR adding this as a feature though.