Telegraf for Splunk

Telegraf
1

Hello Team,

Trying to use telegraf for forwarding telemetry metrics from hashicvault to Splunk, telegraf able to connect to splunk but failing to inject logs.

2021-03-08T16:40:55Z D! Can not parse value: 13 days, 21:26 for key: uptime_format
2021-03-08T16:40:55Z D! Can not parse value: 13 days, 21:26 for key: uptime_format
2021-03-08T16:40:55Z D! Can not parse value: 13 days, 21:27 for key: uptime_format
2021-03-08T16:40:55Z D! Can not parse value: 13 days, 21:27 for key: uptime_format
2021-03-08T16:40:55Z D! [outputs.http] Buffer fullness: 149 / 100000 metrics
2021-03-08T16:40:55Z E! [agent] Error writing to outputs.http: when writing to [https://http-inputs-XXXdevstests.splunkcloud.com:443/services/collector/event] received status code: 400

2

Which input plugin is used?
Which output plugin is used?
Please post the relevant parts of the telegraf config file here in markdown format:

```toml
put you config code snippets here
```
3

[quote=“Franky1, post:2, topic:18765”]

t you config code snippets here
[global_tags]
  index="vault-metrics"
  datacenter = "us-east-2"
  role       = "vault-server"
  cluster    = "http://XXXX.abc.123.com:8201"

# Agent options around collection interval, sizes, jitter and so on
[agent]
  interval = "10s"
  round_interval = true
  metric_batch_size = 1000
  metric_buffer_limit = 10000
  collection_jitter = "0s"
  flush_interval = "10s"
  flush_jitter = "0s"
  precision = ""
  hostname = ""
  omit_hostname = false


# An output plugin that can transmit metrics over HTTP to Splunk
# You must specify a valid Splunk HEC token as the Authorization value
[[outputs.http]]
  url = "https://http-inputs-XXXdevstests.splunkcloud.com:443/services/collector/event"
  data_format="splunkmetric"
  splunkmetric_hec_routing=true
  [outputs.http.headers]
    Content-Type = "application/json"
    Authorization = "Splunk XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX"
4

I suspect (based on the 400 response) that something is wrong with either the Splunk configuration in outputs.http of Telegraf or the (input) configuration in Splunk itself.