All Apps and Add-ons

splunk-connect for Kubernetes :config error file="/fluentd/etc/fluent.conf" error="valid options are http,https but got

bvivi57
Observer

Hi
I'm trying to deploy the splunk connector on my kubernetes cluster. Here is my config file

global: splunk:
hec:
token: 16e1174f-0989-4410-b801-225ff63ef7b8
host: srvinf.coolcorp.priv
port: 8088
indexName: idx_k8s_logs
insecureSSL: true kubernetes:
# connection to kubernetes is insecure
insecureSSL: true

splunk-kubernetes-metrics: splunk:
hec:
indexName: idx_k8s_metric

I deploy the solution with the command "helm install splunk-collector -f splunk-conf.yaml https://github.com/splunk/splunk-connect-for-kubernetes/releases/download/1.4.0/splunk-connect-for-k..."

Unfortunately, some pod crashes on a loop.

root@k8s-worker-001:/home/bvivi57#
docker logs ce9940e8f4d2 2020-04-21
07:47:21 +0000 [info]: parsing config
file is succeeded
path="/fluentd/etc/fluent.conf"
2020-04-21 07:47:21 +0000 [info]: gem
'fluent-plugin-jq' version '0.5.1'
2020-04-21 07:47:21 +0000 [info]: gem
'fluent-plugin-kubernetes_metadata_filter'
version '2.4.2' 2020-04-21 07:47:21
+0000 [info]: gem 'fluent-plugin-prometheus' version
'1.7.0' 2020-04-21 07:47:21 +0000
[info]: gem
'fluent-plugin-record-modifier'
version '2.1.0' 2020-04-21 07:47:21
+0000 [info]: gem 'fluent-plugin-splunk-hec' version
'1.2.1' 2020-04-21 07:47:21 +0000
[info]: gem 'fluentd' version '1.9.1'
2020-04-21 07:47:22 +0000 [error]:
config error in:

@type splunk_hec data_type metric

metric_name_key "metric_name"

metric_value_key "value" protocol

hec_host "http://srvinf.coolcorp.priv"
hec_port 8088 hec_token
"5285bf89-5c6c-4ca4-82de-71ce95d227fc"
host "k8s-worker-001" index
"idx_k8s_metric" source "${tag}"

insecure_ssl true

@type memory
chunk_limit_records 10000
chunk_limit_size 100m
flush_interval 5s
flush_thread_count 1
overflow_action block
retry_max_times 3
total_limit_size 400m

2020-04-21 07:47:22 +0000 [error]:
config error
file="/fluentd/etc/fluent.conf"
error_class=Fluent::ConfigError
error="valid options are http,https
but got "

I can't understand my mistake. Can you help me?

0 Karma

bvivi57
Observer

I find my problem :

I must add "protocol: https" on yaml file

global:
splunk:
hec:
protocol: https

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...