splunk-connect-kuberentes to splunk light - no data error

5/17/2019

I have configured splunk-connect-kubernetes on my cluster and I have told it to send data to splunk-light where I have configured HEC.

HEC is setup correctly because I can POST information directly. However, in splunk-connect-kubernetes I am seeing this in the logs:

2019-05-17 17:10:47 +0000 [error]: #0 Failed POST to http://splunk.default.svc.licence.local:8088/services/collector, response: {"text":"No data","code":5}
-- Mike Chinaloy
kubernetes
splunk

1 Answer

5/21/2019

I believe this is due to:

https://answers.splunk.com/answers/458247/how-to-pass-fields-parameter-in-servicescollector.html

Specifically, HEC only supports a specific set of known fields.

-- Mike Chinaloy
Source: StackOverflow