Proposed title of this feature request:

Feature to enable "auto_extract_timestamp=true" from Red hat logging operator to splunk.

Why does the customer need this? (List the business requirements):

Currently what happens is that the URL specified in the cluster log forwarder output config has the path “/services/collector/event” added to it, and we need to add “?auto_extract_timestamp=true” to the end of that, but there is no route to do that at the moment. If we add it to the base URL, or to the base URL with "/services/collector/event" added, the CLF still adds this path after it, which seems to stop Splunk reading the query string switch properly. What we get sent is:

https://<host>?auto_extract_timestamp=true/services/collector/event
https://<host>/services/collector/event?auto_extract_timestamp=true/services/collector/event
Neither of these work. What CLF needs to send is:
https://<host>/services/collector/event?auto_extract_timestamp=true

Currently there does not seem to be a way to set additional Splunk parameters to work in this way.

List any affected packages or components.

RHOL 6

Vector collector