How to specify a static Splunk source containing special characters like colons in RHOCP 4
Issue
- After upgrading OpenShift Logging from version 5.x to 6.x, logs are no longer categorized under the default source defined on the Splunk HEC token.
- Splunk shows granular sources such as
openshiftAPI,kubeAPI, ornamespace_name_podName_containerNameinstead of a single unified source. -
Attempting to set a static source in the
ClusterLogForwarderoutput configuration that contains a colon (for example,http:my_source) fails with a validation error.spec.outputs[0].splunk.source: Invalid value: "http:my_source": spec.outputs[0].splunk.source in body should match '^(([a-zA-Z0-9-_.\/])({(\.[a-zA-Z0-9_]+|\."[^"]+")+((||)(\.[a-zA-Z0-9_]+|\.?"[^"]+")+)||"[^"]"}))*$'
Environment
- Red Hat OpenShift Container Platform (RHOCP)
- 4.16 and later
- Red Hat OpenShift Logging (RHOL)
- 6.x
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.