Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[exporter/splunkhec] Use ObservedTimestamp if Timestamp is empty #39221

Open
KevinThompsonYCRX opened this issue Apr 7, 2025 · 2 comments · May be fixed by #39317
Open

[exporter/splunkhec] Use ObservedTimestamp if Timestamp is empty #39221

KevinThompsonYCRX opened this issue Apr 7, 2025 · 2 comments · May be fixed by #39317
Labels
enhancement New feature or request exporter/splunkhec

Comments

@KevinThompsonYCRX
Copy link

Component(s)

exporter/splunkhec

Is your feature request related to a problem? Please describe.

Currently the Splunk HEC exporter takes the Timestamp field from each log record. If the timestamp field is not provided on the LogRecord, then this is passing 0 today. According to the OTel Spec, the ObservedTimestamp is recommended to be used when the Timestamp field is not provided: https://opentelemetry.io/docs/specs/otel/logs/data-model/#field-observedtimestamp

Splunk adds the ingestion time as a timestamp, but if the service is interrupted or delayed, this can cause issues trying to queue & re-ingest logs.

Describe the solution you'd like

I'd recommend either passing both the Timestamp and ObservedTimestamp, or add the recommended logic to pass the ObservedTimestamp as the Timestamp if Timestamp is not present.

opentelemetry-collector-contrib/exporter/splunkhecexporter/logdata_to_splunk.go

Line 122 in d1f2818

Time: nanoTimestampToEpochMilliseconds(lr.Timestamp()),

Describe alternatives you've considered

Can use a transform processor to get around this for now

Additional context

No response
@KevinThompsonYCRX KevinThompsonYCRX added enhancement New feature or request needs triage New item requiring triage labels Apr 7, 2025
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Apr 7, 2025

Pinging code owners:

See Adding Labels via Comments if you do not have permissions to add labels yourself.

@github-actions github-actions bot mentioned this issue Apr 8, 2025
Open
JaredTan95 added a commit to openinsight-proj/opentelemetry-collector-contrib that referenced this issue Apr 11, 2025
@JaredTan95
fix open-telemetry#39221
3bc281d 
Signed-off-by: Jared Tan <[email protected]>

Signed-off-by: Jared Tan <[email protected]>
@JaredTan95 JaredTan95 linked a pull request Apr 11, 2025 that will close this issue
Open
@JaredTan95
Copy link
Member

Yes, we can following elasticsearchexporter did.

opentelemetry-collector-contrib/exporter/elasticsearchexporter/model.go

Line 564 in 2766731

if record.Timestamp() != 0 {

@JaredTan95 JaredTan95 removed the needs triage New item requiring triage label Apr 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request exporter/splunkhec
Projects
None yet
Milestone
No milestone
2 participants
@JaredTan95 @KevinThompsonYCRX