Splunk Enterprise, using a heavy forwarder to collect http.
Getting this error:

WARNING c.s.s.utils.LogConsumer#run: content length:313java.io.IOException: failed to send data,Bad Request
at com.splunk.splunkjenkins.utils.LogConsumer$1.handleResponse(LogConsumer.java:63)
at com.splunk.splunkjenkins.utils.LogConsumer$1.handleResponse(LogConsumer.java:43)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:222)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:164)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:139)
at com.splunk.splunkjenkins.utils.LogConsumer.run(LogConsumer.java:84)
Caused by: com.splunk.splunkjenkins.utils.LogConsumer$SplunkClientError: incorrect index or invalid data format,Bad Request
at com.splunk.splunkjenkins.utils.LogConsumer$1.handleResponse(LogConsumer.java:61)
... 5 more

source=jenkins
host=jenkins-master
index=jenkins_statistics
build_report.index=jenkins
file.index=jenkins_artifact
console_log.index=jenkins_console
jenkins_config.enabled=true

I am getting some data (index=jenkins, sourcetype=_json, source=jenkins)

Any ideas?