Skip to content

[splunkhecreceiver] Align acking behavior with that of Splunk Enterprise #32995

Closed
@zpzhuSplunk

Description

@zpzhuSplunk

Component(s)

receiver/splunkhec

Is your feature request related to a problem? Please describe.

Currently, the channelID used for hec Ack in Splunk Enterprise is not case sensitive, but it is in the hecreceiver.

In addition, Splunk enterprise supports channelId input via the query params, but the hec receiver only supports passing of channelID through the header.

The hecreceiver's supported features/behaviors should mirror that of Splunk Enterprise more closely.

Describe the solution you'd like

  • Make the channelID header case-insensitive
  • Make hecreceiver endpoints able to extract channelID from query params

Describe alternatives you've considered

No response

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions