Skip to content

Commit 4e50ff1

Browse files
author
Ludovic Boutros
committed
Doc: Update README with new parameter
1 parent f085b26 commit 4e50ff1

File tree

1 file changed

+6
-4
lines changed

1 file changed

+6
-4
lines changed

README.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@ Use the below schema to configure Splunk Connect for Kafka
107107
"splunk.hec.raw": "<true|false>",
108108
"splunk.hec.raw.line.breaker": "<line breaker separator>",
109109
"splunk.hec.json.event.enrichment": "<key value pairs separated by comma, only applicable to /event HEC>",
110+
"splunk.hec.auto.extract.timestamp": "<true|false>",
110111
"value.converter": "<converter class used to convert between Kafka Connect format and the serialized form that is written to Kafka>",
111112
"value.converter.schema.registry.url": "<Schema-Registry-URL>",
112113
"value.converter.schemas.enable": "<true|false>",
@@ -196,10 +197,11 @@ Use the below schema to configure Splunk Connect for Kafka
196197
|-------- |----------------------------|-----------------------|
197198
| `splunk.hec.raw.line.breaker` | Only applicable to /raw HEC endpoint. The setting is used to specify a custom line breaker to help Splunk separate the events correctly.</br> **NOTE:** <br/> For example, you can specify `"#####"` as a special line breaker. Internally, the Splunk Kafka Connector will append this line breaker to every Kafka record to form a clear event boundary. The connector performs data injection in batch mode. On the Splunk platform side, you can configure **`props.conf`** to set up line breaker for the sourcetypes. Then the Splunk software will correctly break events for data flowing through /raw HEC endpoint. For questions on how and when to specify line breaker, go to the FAQ section.|`""`|
198199
##### /event endpoint only
199-
| Name | Description | Default Value |
200-
|-------- |----------------------------|-----------------------|
201-
| `splunk.hec.json.event.enrichment` | Only applicable to /event HEC endpoint. This setting is used to enrich raw data with extra metadata fields. It contains a list of key value pairs separated by ",". The configured enrichment metadata will be indexed along with raw event data by Splunk software. </br> **NOTE:** <br/> Data enrichment for /event HEC endpoint is only available in Splunk Enterprise 6.5 and above. By default, this setting is empty. See ([Documentation](http://dev.splunk.com/view/event-collector/SP-CAAAE8Y#indexedfield)) for more information. <br/>**Example:** `org=fin,bu=south-east-us`||
202-
| `splunk.hec.track.data` | When set to `true`, data loss and data injection latency metadata will be indexed along with raw data. This setting only works in conjunction with /event HEC endpoint (`"splunk.hec.raw" : "false"`). Valid settings are `true` or `false`. |`false`|
200+
| Name | Description | Default Value |
201+
|-------- |----------------------------|---------------|
202+
| `splunk.hec.json.event.enrichment` | Only applicable to /event HEC endpoint. This setting is used to enrich raw data with extra metadata fields. It contains a list of key value pairs separated by ",". The configured enrichment metadata will be indexed along with raw event data by Splunk software. </br> **NOTE:** <br/> Data enrichment for /event HEC endpoint is only available in Splunk Enterprise 6.5 and above. By default, this setting is empty. See ([Documentation](http://dev.splunk.com/view/event-collector/SP-CAAAE8Y#indexedfield)) for more information. <br/>**Example:** `org=fin,bu=south-east-us`| |
203+
| `splunk.hec.track.data` | When set to `true`, data loss and data injection latency metadata will be indexed along with raw data. This setting only works in conjunction with /event HEC endpoint (`"splunk.hec.raw" : "false"`). Valid settings are `true` or `false`. | `false` |
204+
| `splunk.hec.auto.extract.timestamp` | Sends timestamped events to HTTP Event Collector using the Splunk platform JSON event protocol when auto_extract_timestamp is set to `true` in the /event URL. | `unset` |
203205

204206
### Headers Parameters
205207
#### Use Headers

0 commit comments

Comments
 (0)