Skip to content

Sink Connector does not copy "record key" into SPLUNK  #323

@bluedog13

Description

@bluedog13

While running the sink connector I noticed that the record "key" was not being logged into SPLUNK. Is there anything specific that needs to be done to record the "key".

The message offset, the message headers are available in SPLUNK as expected - the below has been used in the config file

"splunk.hec.track.data"  : "true",

The entire config file is

{
    "name"                                      : "[redacted]",
    "topics"                                    : "[redacted]",
    "input.data.format"                         : "[redacted]",
    "connector.class"                           : "SplunkSink",
    "kafka.auth.mode"                           : "KAFKA_API_KEY",
    "kafka.api.key"                             : "[redacted]",
    "kafka.api.secret"                          : "[redacted]",
    "splunk.hec.uri"                            : "https://splunk.[redacted].io:443",
    "splunk.hec.token"                          : "[redacted]",
    "splunk.indexes"                            : "[redacted]",
    "splunk.sources"                            : "[redacted]",
    "splunk.hec.ssl.validate.certs"             : "false",
    "splunk.hec.raw"                            : "false",
    "splunk.hec.track.data"                     : "true",
    "splunk.hec.http.keepalive"                 : "true",
    "splunk.hec.max.http.connection.per.channel": "2",
    "splunk.hec.total.channels"                 : "2",
    "splunk.hec.socket.timeout"                 : "60",
    "splunk.hec.use.record.timestamp"           : "true",
    "splunk.hec.threads"                        : "1",
    "splunk.hec.max.outstanding.events"         : "10000",
    "splunk.hec.max.retries"                    : "5",
    "splunk.hec.backoff.threshhold.seconds"     : "60",
    "splunk.hec.json.event.formatted"           : "false",
    "splunk.hec.max.batch.size"                 : "500",
    "splunk.hec.lb.poll.interval"               : "120",
    "splunk.flush.window"                       : "10",
    "splunk.hec.ack.enabled"                    : "false",
    "splunk.header.support"                     : "true",
    "tasks.max"                                 : "3"
}

Much appreciated.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions