How to specify a static Splunk source containing special characters like colons in RHOCP 4

Solution Verified - Updated -

Issue

  • After upgrading OpenShift Logging from version 5.x to 6.x, logs are no longer categorized under the default source defined on the Splunk HEC token.
  • Splunk shows granular sources such as openshiftAPI, kubeAPI, or namespace_name_podName_containerName instead of a single unified source.
  • Attempting to set a static source in the ClusterLogForwarder output configuration that contains a colon (for example, http:my_source) fails with a validation error.

    spec.outputs[0].splunk.source: Invalid value: "http:my_source": spec.outputs[0].splunk.source in body should match '^(([a-zA-Z0-9-_.\/])({(\.[a-zA-Z0-9_]+|\."[^"]+")+((||)(\.[a-zA-Z0-9_]+|\.?"[^"]+")+)||"[^"]"}))*$'
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4.16 and later
  • Red Hat OpenShift Logging (RHOL)
    • 6.x

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content