in_splunk: preserve raw payload without auth header

Signed-off-by: Eduardo Silva <eduardo@chronosphere.io>

Author: edsiper

plugins/in_splunk/splunk_prot.c

@@ -189,16 +189,21 @@ static int process_raw_payload_pack(struct flb_splunk *ctx,
         }
     }
     else {
-        if (ingested_auth_header != NULL) {
-            if (ret == FLB_EVENT_ENCODER_SUCCESS) {
+        if (ret == FLB_EVENT_ENCODER_SUCCESS) {
+            if (ingested_auth_header != NULL) {
                 ret = flb_log_event_encoder_append_body_values(
                     encoder,
                     FLB_LOG_EVENT_CSTRING_VALUE(ctx->store_token_key),
                     FLB_LOG_EVENT_STRING_VALUE(ingested_auth_header,
                                                ingested_auth_header_len),
                     FLB_LOG_EVENT_CSTRING_VALUE("log"),
                     FLB_LOG_EVENT_STRING_VALUE(buf, size));
-
+            }
+            else {
+                ret = flb_log_event_encoder_append_body_values(
+                    encoder,
+                    FLB_LOG_EVENT_CSTRING_VALUE("log"),
+                    FLB_LOG_EVENT_STRING_VALUE(buf, size));
             }
         }
     }