Align malformed data handling with splunkd

[splunkericl]

Component(s)

receiver/splunkhec

Is your feature request related to a problem? Please describe.

When ingesting data into splunkhecreceiver via /services/collector/event endpoint, the behavior is different than splunkd if the payload is malformed.

For example:
payload:

{"@timestamp":"2023-09-13T21:36:46.456Z","tailed_path":"/cfp/logs/archive/dldl/clientlogrepository/20230913/E866004.log","source":"gtidatabus","fluentd_utc_timestamp":"2023-09-13T21:36:29.028898541Z","deployment_id":"1234","@version":"1","env":"test","app_id":"123","application_name":"jhffdjhkfd","event":"2023-09-14 03:06:22,214 +05:30 [INFO] [1323] [ContainerApi] [StatsCollector] Skipped frame stats entry for statsCounter={} 720","tags":["_dateparsefailure"],"host":"jkgfdjkhgfdjhk","app_resolver_grp":"d2bnrgojpmm","seal_id":"1231213","os_resolver_grp":"jhgvjhkgfjkdf","s_sourcetype":"fkfjkfjf", "sourcetype": "nb:hec:event"}

splunkhecreceiver accepts the data but has significant payload difference
splunkd would return No Data with code 5

Describe the solution you'd like

align the behavior of splunkhecreceiver if the data is malformed. Return response of {"text":"No data", "code":5} instead

Describe alternatives you've considered

No response

Additional context

No response

[github-actions]

Pinging code owners:

• receiver/splunkhec: @atoulme

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[atoulme]

Sure, do you want to work on this?

[splunkericl]

Hey @atoulme . This seems like a lower priority item so we don't have to work on it yet. Can we keep this up for tracking purposes? We might get to it one day when this becomes more urgent.

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

Pinging code owners:

• receiver/splunkhec: @atoulme

See Adding Labels via Comments if you do not have permissions to add labels yourself.