-
Notifications
You must be signed in to change notification settings - Fork 107
Closed
Labels
Description
While running the sink connector I noticed that the record "key" was not being logged into SPLUNK. Is there anything specific that needs to be done to record the "key".
The message offset, the message headers are available in SPLUNK as expected - the below has been used in the config file
"splunk.hec.track.data" : "true",
The entire config file is
{
"name" : "[redacted]",
"topics" : "[redacted]",
"input.data.format" : "[redacted]",
"connector.class" : "SplunkSink",
"kafka.auth.mode" : "KAFKA_API_KEY",
"kafka.api.key" : "[redacted]",
"kafka.api.secret" : "[redacted]",
"splunk.hec.uri" : "https://splunk.[redacted].io:443",
"splunk.hec.token" : "[redacted]",
"splunk.indexes" : "[redacted]",
"splunk.sources" : "[redacted]",
"splunk.hec.ssl.validate.certs" : "false",
"splunk.hec.raw" : "false",
"splunk.hec.track.data" : "true",
"splunk.hec.http.keepalive" : "true",
"splunk.hec.max.http.connection.per.channel": "2",
"splunk.hec.total.channels" : "2",
"splunk.hec.socket.timeout" : "60",
"splunk.hec.use.record.timestamp" : "true",
"splunk.hec.threads" : "1",
"splunk.hec.max.outstanding.events" : "10000",
"splunk.hec.max.retries" : "5",
"splunk.hec.backoff.threshhold.seconds" : "60",
"splunk.hec.json.event.formatted" : "false",
"splunk.hec.max.batch.size" : "500",
"splunk.hec.lb.poll.interval" : "120",
"splunk.flush.window" : "10",
"splunk.hec.ack.enabled" : "false",
"splunk.header.support" : "true",
"tasks.max" : "3"
}
Much appreciated.