All Apps and Add-ons

Splunk connect for Kafka Issue - failed to send batch SplunkSinkTask

chskm
Path Finder

I have tried connecting with Splunk connect for Kakfa in multiple scenarios, where i'm keep on receiving the error as below and I'm not receiving the data to Splunk Indexers. I have an intermediate forwarder between Kafka server and Splunk indexer. I have tried sending a test message from Kafka server using the HEC token which is generated on HF. It works totally fine and I'm receiving the data to indexer. But, when I'm using curl command as per docs i'm not receiving the data. Could you please advise:

ERROR failed to send batch (com.splunk.kafka.connect.SplunkSinkTask:261)
java.lang.IllegalArgumentException: Illegal character in scheme name at index 0: :8088/services/collector/raw?index=kafka_connect
at java.base/java.net.URI.create(URI.java:883)
at org.apache.http.client.methods.HttpPost.(HttpPost.java:73)
at com.splunk.hecclient.Indexer.send(Indexer.java:115)
at com.splunk.hecclient.HecChannel.send(HecChannel.java:61)
at com.splunk.hecclient.LoadBalancer.send(LoadBalancer.java:56)
at com.splunk.hecclient.Hec.send(Hec.java:233)
at com.splunk.kafka.connect.SplunkSinkTask.send(SplunkSinkTask.java:257)
at com.splunk.kafka.connect.SplunkSinkTask.handleFailedBatches(SplunkSinkTask.java:127)
at com.splunk.kafka.connect.SplunkSinkTask.put(SplunkSinkTask.java:62)
at org.apache.kafka.connect.runtime.WorkerSinkTask.deliverMessages(WorkerSinkTask.java:564)
at org.apache.kafka.connect.runtime.WorkerSinkTask.poll(WorkerSinkTask.java:322)
at org.apache.kafka.connect.runtime.WorkerSinkTask.iteration(WorkerSinkTask.java:225)
at org.apache.kafka.connect.runtime.WorkerSinkTask.execute(WorkerSinkTask.java:193)
at org.apache.kafka.connect.runtime.WorkerTask.doRun(WorkerTask.java:175)
at org.apache.kafka.connect.runtime.WorkerTask.run(WorkerTask.java:219)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: java.net.URISyntaxException: Illegal character in scheme name at index 0: 10.225.198.57:8088/services/collector/raw?index=kafka_connect
at java.base/java.net.URI$Parser.fail(URI.java:2915)
at java.base/java.net.URI$Parser.checkChars(URI.java:3086)
at java.base/java.net.URI$Parser.checkChar(URI.java:3096)
at java.base/java.net.URI$Parser.parse(URI.java:3111)
at java.base/java.net.URI.(URI.java:600)
at java.base/java.net.URI.create(URI.java:881)
... 19 more
[2018-11-18 00:45:35,596] INFO handled 1 failed batches with 2 events (com.splunk.kafka.connect.SplunkSinkTask:130)

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...