Splunk-connect-for-kubernetes: Kubernetes events are not getting forwarded to splunk

[beth2016]

In Splunk_object_values.yaml, i do see events set to watch mode. But I am not seeing these in splunk. Is the sourcetype="kube:objects:events" the correct search filter? thanks.

objects:
core:
v1:
- name: pods
- name: namespaces
- name: nodes
- name: events
mode: watch

[sayeedc]

Sourcetype is kube:objects:events:watch . I am seeing the same problem in splunk. We've not seen any events picked up over the last 30 days from multiple openshift clusters.

[beth2016]

splunk team, Is there any ETA on when this bug will be fix?

[frundh]

I have the same problem and I have tried different versions of splunk/kube-objects. 1.1.0 stops working after about an hour. 1.1.1 & 1.1.2 (rc) do not stop, but for some reason they only collect a small portion of all events.

So far the only version that works for me is peter-moffatt's PR
https://github.com/splunk/fluent-plugin-kubernetes-objects/pull/13
Here is a docker file if you want to build it
https://github.com/frundh/fluent-plugin-kubernetes-objects/blob/moffatt/docker/Dockerfile

Related issue
https://github.com/splunk/fluent-plugin-kubernetes-objects/issues/9

[frundh]

I have been running splunk/kube-objects:1.1.2 successfully for 24h (note SCK 1.2.0 uses splunk/kube-objects:1.1.0 and sourcetype has changed from kube:objects:events:watch to kube:objects:events)

[beth2016]

@frundh thanks for the update. good to know. Do you happen to have the dockerfile for this version?
I checked here https://github.com/splunk/docker-kube-objects, looks like this was not updated yet. thanks :)

[frundh]

@beth2016 I think this is the repo you want:
https://github.com/splunk/fluent-plugin-kubernetes-objects
It is available on docker hub:
https://hub.docker.com/r/splunk/kube-objects/tags