Timestamp warning in collector pods forwarding logs to Splunk in RHOCP 4

Solution Verified - Updated -

Issue

  • Vector pods show the below warning log:

    WARN sink{component_kind="sink" component_id=splunk component_type=splunk_hec_logs component_name=splunk}: vector::internal_events::splunk_hec::sink: Timestamp was not found. Deferring to Splunk to set the timestamp. internal_log_rate_limit=true
    WARN sink{component_kind="sink" component_id=splunk component_type=splunk_hec_logs component_name=splunk}: vector::internal_events::splunk_hec::sink: Internal log [Timestam was not found. Deferring to Splunk to set the timestamp.] is being rate limited.
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4
  • Red Hat Openshift Logging (RHOL)
    • 5.7.4
  • Vector

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content