Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[receiver/splunkhec] Metrics ingestion behavior is not consistent with Splunk Cloud/Enterprise #38464

Closed
splunkericl opened this issue Mar 7, 2025 · 2 comments · Fixed by #38585
Labels
bug Something isn't working receiver/splunkhec

Comments

@splunkericl
Copy link
Contributor

Component(s)

receiver/splunkhec

What happened?

Description

Currently, there is inconsistent behavior between splunkhecreceiver vs splunk enterprise/cloud on metrics ingestion support. Ideally, hecreceiver should align with splunk enterprise/cloud.

The current documentation says Metrics data, which requires an event field set to metric., but this is not accurate and we are working with splunk doc team to update this.

The event field can be optional

Steps to Reproduce

  1. create a metric event
  2. do not set event field at all
  3. send to splunkhecreceiver

Expected Result

  1. data is accepted

Actual Result

  1. data is rejected with 400

Collector version

latest

Environment information

N/A

OpenTelemetry Collector configuration

Log output

Additional context

No response

@splunkericl splunkericl added bug Something isn't working needs triage New item requiring triage labels Mar 7, 2025
Copy link
Contributor

github-actions bot commented Mar 7, 2025

Pinging code owners:

See Adding Labels via Comments if you do not have permissions to add labels yourself.

@atoulme atoulme removed the needs triage New item requiring triage label Mar 8, 2025
@atoulme
Copy link
Contributor

atoulme commented Mar 8, 2025

Sure, please update the documentation and please feel free to offer a fix.

atoulme pushed a commit that referenced this issue Mar 14, 2025

Verified

This commit was signed with the committer’s verified signature.
Fdawgs Frazer Smith
<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
#### Description

Splunk HEC metrics accepts metrics when `"event": ""`. This aligns with
Splunk HEC behavior

<!-- Issue number (e.g. #1234) or full URL to issue, if applicable. -->
#### Link to tracking issue
Fixes
[38464](#38464)

<!--Describe what testing was performed and which tests were added.-->
#### Testing

Unit tests

<!--Describe the documentation added.-->
#### Documentation

<!--Please delete paragraphs that you did not use before submitting.-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working receiver/splunkhec
Projects
None yet
2 participants