返回
-
标题
Splunk HEC Driver Not Balancing Logs -
说明
Splunk load-balacing between multiple URLs is not working as expected and either only one, or none, of the Splunk instances is receiving logs. -
原因
A product defect exists in Syslog-ng PE version 7.x in which the syntax of the url() in the Splunk HEC driver is incorrectly stated in the documentation and in practice. -
解决办法
Resolution:
Syslog-ng PE version 7.0.15 will contain a fix for this defect in which the syntax will work properly as stated in the documentation and in practice. Below is an example of the correct url() syntax within the syslog-ng.conf file:
url("https://url1" "https://url2" "https://url3")Workaround:
Edit the syslog-ng.conf file where the url() syntax is stated, the syslog-ng.conf file can be located at the following location:
/opt/syslog-ng/etc/syslog-ng.confThe following example syntax shows the currently correct and working method of creating the url() statement within the Syslog-ng.conf file.
url(https://url1" "https://url2" "https://url3) -
其他信息
If applying the workaround into the environment, once upgraded to version 7.0.15 of Syslog-ng the url() syntax changes will need to be reverted to the originally documented syntax as can been seen above under the resolution of this knowledge base article.