I have configured splunk-connect-kubernetes on my cluster and I have told it to send data to splunk-light where I have configured HEC.
HEC is setup correctly because I can POST information directly. However, in splunk-connect-kubernetes I am seeing this in the logs:
2019-05-17 17:10:47 +0000 [error]: #0 Failed POST to http://splunk.default.svc.licence.local:8088/services/collector, response: {"text":"No data","code":5}
I believe this is due to:
https://answers.splunk.com/answers/458247/how-to-pass-fields-parameter-in-servicescollector.html
Specifically, HEC only supports a specific set of known fields.