diff --git a/README.md b/README.md index eae192e1..5ac81642 100644 --- a/README.md +++ b/README.md @@ -173,7 +173,7 @@ Use the below schema to configure Splunk Connect for Kafka | `splunk.hec.json.event.formatted` | Set to `true` for events that are already in HEC format. Valid settings are `true` or `false`. |`false`| | `splunk.hec.max.outstanding.events` | Maximum amount of un-acknowledged events kept in memory by connector. Will trigger back-pressure event to slow down collection if reached. | `1000000` | | `splunk.hec.max.retries` | Amount of times a failed batch will attempt to resend before dropping events completely. Warning: This will result in data loss, default is `-1` which will retry indefinitely | `-1` | -| `splunk.hec.backoff.threshhold.seconds` | The amount of time Splunk Connect for Kafka waits to attempt resending after errors from a HEC endpoint." | `60` | +| `splunk.hec.backoff.threshhold.seconds` | The amount of duration the Indexer object will be stopped after getting error code while posting the data.
**NOTE:**
Other Indexer won't get affected." | `60` | | `splunk.hec.lb.poll.interval` | Specify this parameter(in seconds) to control the polling interval(increase to do less polling, decrease to do more frequent polling, set `-1` to disable polling) | `120` | | `splunk.hec.enable.compression` | Valid settings are true or false. Used for enable or disable gzip-compression. |`false`| ### Acknowledgement Parameters @@ -232,6 +232,13 @@ Use the below schema to configure Splunk Connect for Kafka | `timestamp.regex` | Regex for timestamp extraction.
**NOTE:**
Regex must have name captured group `"time"` For eg.: `\\\"time\\\":\\s*\\\"(?