Splunk HEC source requires channel with ack disabled #22642
-
When testing a basic Splunk HEC source I've noticed that when a payload is sent to the { "text": "Data channel is missing", "code": 10 } The below is my configuration for Vector that I have setup which includes acknowledgment being disabled.
Reading the docs from Splunk found below they mention channel is only required when acknowledgement is enabled, but in Vector it looks like this is required for any payloads sent to the "raw" endpoint regardless if acknowledgement is enabled or not. Is this the intended behavior? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
Hi @objectbased, can you also try with |
Beta Was this translation helpful? Give feedback.
Moved to #22653