Unexpected timestamp type warning in collector pods forwarding logs to Splunk in RHOCP 4 type

Solution Verified - Updated -

Issue

  • Vector pods show the below warning log:

    WARN sink{component_kind="sink" component_id=splunk_receiver component_type=splunk_hec_logs component_name=splunk_receiver}: vector::internal_events::splunk_hec::sink: Timestamp was an unexpected type. Deferring to Splunk to set the timestamp. invalid_type="string" internal_log_rate_limit=true
    WARN sink{component_kind="sink" component_id=splunk_receiver component_type=splunk_hec_logs component_name=splunk_receiver}: vector::internal_events::splunk_hec::sink: Internal log [Timestamp was an unexpected type. Deferring to Splunk to set the timestamp.] is being rate limited.
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4
  • Red Hat Openshift Logging (RHOL)
    • 5.7
    • 5.8
    • 5.9
  • Vector

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content