Timestamp warning in collector pods forwarding logs to Splunk in RHOCP 4
Issue
-
Vector pods show the below warning log:
WARN sink{component_kind="sink" component_id=splunk component_type=splunk_hec_logs component_name=splunk}: vector::internal_events::splunk_hec::sink: Timestamp was not found. Deferring to Splunk to set the timestamp. internal_log_rate_limit=true WARN sink{component_kind="sink" component_id=splunk component_type=splunk_hec_logs component_name=splunk}: vector::internal_events::splunk_hec::sink: Internal log [Timestam was not found. Deferring to Splunk to set the timestamp.] is being rate limited.
Environment
- Red Hat OpenShift Container Platform (RHOCP)
- 4
- Red Hat Openshift Logging (RHOL)
- 5.7.4
- Vector
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.