Hi team,

We are trying to send records into Splunk from a Kafka topic, but we're encountering an issue with how records containing list values in the "fields" key are being parsed. Below is an example of a record we're trying to send:

{"event": "Hello, world!","sourcetype": "cool-fields","fields": {"device": "macbook","users": ["joe", "bob"]}}

However, when the record is sent via the connector, we receive the following error:

event does not follow correct HEC pre-formatted format: {"sourcetype":"cool-fields","event":"Hello, world!","fields":{"device":"macbook","users":["joe","bob"]}} (com.splunk.kafka.connect.SplunkSinkTask:407)

Interestingly, if we manually send the same record using a curl command, Splunk is able to correctly parse and store it without any issues.

Could you please help us understand why this discrepancy is happening and assist us with resolving the issue?

Thanks in advance!