/ Jan 20th, 2020 /

The `splunk_hec` sink does not index fields by default

This gives you full control over which fields are indexed

There is no longer a distinction within Vector between explicit and implicit event fields. All fields are now implicit and therefore the splunk_hec sink will not index any fields by default.

Upgrade Guide

In order to mark desired fields as indexed you can use the optional configuration option indexed_fields:

type = "splunk_hec"
inputs = ["my-source-id"]
+ indexed_fields = ["foo", "bar"]

This change was made available in 0.7.0. You can get this change by downloading the latest stable release.

Like What You See?