app/vlinsert: splunk support

[AndrewChubatiuk]

Describe Your Changes

• replaced fastjson.Parser with fastjson.Scanner, since one line can contains multiple log entries
• added separate endpoint for Splunk HEC events
• since no collector, that supports Splunk events provides an ability to set extra HTTP headers or extra args, -splunk.* cmd arguments were added

Checklist

The following checks are mandatory:

• My change adheres to VictoriaMetrics contributing guidelines.
• My change adheres to VictoriaMetrics development goals.

[AndrewChubatiuk]

@valyala could you please take a look at this PR?

[vadimalekseev]

Should we support the /services/collector/raw and /services/collector/health endpoints?
In log collectors like Vector and FluentBit, you can choose between different event/raw modes.

See https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTREF/RESTinput#services.2Fcollector.2Fraw

---

JFYI: I also noticed there is /services/collector/mint endpoint, but it looks like other log collectors do not support it: https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTREF/RESTinput#services.2Fcollector.2Fmint

[AndrewChubatiuk]

no need to support mint, as it's deprecated, added /health support. Regarding raw not sure how should accepted data be treated. There's no strict boundary between type passed via sourcetype and received data. Also which source types should we automatically parse and which should just accept as is