@@ -15,6 +15,7 @@ import (

 	"net/url"

 	"os"

 	"strconv"

+	"strings"

 	"sync"

 	"time"

@@ -363,6 +364,11 @@ func (l *splunkLoggerJSON) Log(msg *logger.Message) error {

 }

 func (l *splunkLoggerRaw) Log(msg *logger.Message) error {

+	// empty or whitespace-only messages are not accepted by HEC

+	if strings.TrimSpace(string(msg.Line)) == "" {

+		return nil

+	}

+

 	message := l.createSplunkMessage(msg)

 	message.Event = string(append(l.prefix, msg.Line...))

@@ -713,12 +713,19 @@ func TestRawFormatWithoutTag(t *testing.T) {

 	if err := loggerDriver.Log(&logger.Message{Line: []byte("notjson"), Source: "stdout", Timestamp: message2Time}); err != nil {

 		t.Fatal(err)

 	}

+	message3Time := time.Now()

+	if err := loggerDriver.Log(&logger.Message{Line: []byte(" "), Source: "stdout", Timestamp: message3Time}); err != nil {

+		t.Fatal(err)

+	}

 	err = loggerDriver.Close()

 	if err != nil {

 		t.Fatal(err)

 	}

+	// message3 would have an empty or whitespace only string in the "event" field

+	// both of which are not acceptable to HEC

+	// thus here we must expect 2 messages, not 3

 	if len(hec.messages) != 2 {

 		t.Fatal("Expected two messages")

 	}