SplunkHecOutput: Failed POST - {"text":"Invalid data format","code":6,"invalid-event-number":0}

[jaypalpatil]

Dear Team,

I have deployed fluentd manifest file and getting the below error

Error on Kubernetes side
2021-02-23 09:39:33 +0000 [error]: #0 Fluent::Plugin::SplunkHecOutput: Failed POST to http://10.69.82.42:8088/services/collector, response: {"text":"Invalid data format","code":6,"invalid-event-number":0}
2021-02-23 09:39:38 +0000 [error]: #0 Failed POST to http://10.69.82.42:8088/services/collector, response: {"text":"Invalid data format","code":6,"invalid-event-number":0}

BR,
JP

[rockb1017]

Are you using helm to deploy SCK?

[jaypalpatil]

Hi,

Deployed using the Manifest files

[jaypalpatil]

Using the SCK Manifest files...

[jagadeesh-kancherla-tfs]

2021-03-31 11:26:31 +0000 [error]: #0 Failed POST to https://http-inputs-xxx.splunkcloud.com/services/collector, response: {"text":"Incorrect index","code":7,"invalid-event-number":1}
2021-03-31 11:26:31 +0000 [error]: #0 Fluent::Plugin::SplunkHecOutput: Failed POST to https://http-inputs-xxx.splunkcloud.com/services/collector, response: {"text":"Incorrect index","code":7,"invalid-event-number":1}

[vinzent]

The important part is: Incorrect index

check your splunk.com/index Annotation on the pod or namespace. Or the default index in the fluentd config.

[rajathithan]

can any one let me know how you resolved the "text":"Invalid data format" issue.

[parjinderpannu]

Unfortunately it is not clear on how "text":"Invalid data format" issue is resolved.