Unexpected timestamp type warning in collector pods forwarding logs to Splunk in RHOCP 4 type
Issue
-
Vector pods show the below warning log:
WARN sink{component_kind="sink" component_id=splunk_receiver component_type=splunk_hec_logs component_name=splunk_receiver}: vector::internal_events::splunk_hec::sink: Timestamp was an unexpected type. Deferring to Splunk to set the timestamp. invalid_type="string" internal_log_rate_limit=true WARN sink{component_kind="sink" component_id=splunk_receiver component_type=splunk_hec_logs component_name=splunk_receiver}: vector::internal_events::splunk_hec::sink: Internal log [Timestamp was an unexpected type. Deferring to Splunk to set the timestamp.] is being rate limited.
Environment
- Red Hat OpenShift Container Platform (RHOCP)
- 4
- Red Hat Openshift Logging (RHOL)
- 5.7
- 5.8
- 5.9
- Vector
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.