#23022 Allow content-type header if it only includes application/json…

[tot19]

feat: Allow content-type header if it only includes application/json for Splunk HEC source

Summary

Updated the Splunk HEC source to accept requests that contain the header content-type with any value containing "application/json," not the exact value of "application/json."

Change Type

• Bug fix
• [ X] New feature
• Non-functional (chore, refactoring, docs)
• Performance

Is this a breaking change?

• Yes
• [ X] No

How did you test this PR?

Tested locally with new build

Request on new version:
`curl -i -X POST "$MY_SERVER" -H "Authorization: Splunk $MY_TOKEN" -H "X-Splunk-Request-Channel: $(uuidgen)" -H 'Content-Type: application/json' --data '{"acks":[0]}' && echo
HTTP/1.1 400 Bad Request
content-type: application/json
content-length: 36
date: Sat, 10 May 2025 15:39:22 GMT

{"text":"Ack is disabled","code":14}`

Request on old version:
`curl -i -X POST "$MY_SERVER" -H "Authorization: Splunk $MY_TOKEN" -H "X-Splunk-Request-Channel: $(uuidgen)" -H 'Content-Type: application/json' --data '{"acks":[0]}' && echo
HTTP/1.1 415 Unsupported Media Type
content-type: text/plain; charset=utf-8
content-length: 43
date: Sat, 10 May 2025 09:26:39 GMT

The request's content-type is not supported`

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• [X ] No. A maintainer will apply the "no-changelog" label to this PR.

References

Closes #23022

[bits-bot]

All committers have signed the CLA.

[tot19]

Closing