fix(ci): fix Splunk integration test flakiness and re-enable

[thomasqueirozb]

Summary

Fixes #23474 - Splunk integration tests were timing out due to two issues:

1. Incorrect volume path in compose.yaml (introduced during integration test reorganization)
2. Missing health check causing tests to start before Splunk was ready

Vector configuration

NA

How did you test this PR?

• Verified the fix by running make check-clippy
• The changes address root causes identified from the issue

/ci-run-integration-splunk
https://github.com/vectordotdev/vector/actions/runs/29761543841/job/88417689710?pr=25879

Change Type

• Bug fix
• New feature
• Dependencies
• Non-functional (chore, refactoring, docs)
• Performance

Is this a breaking change?

• Yes
• No

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

References

• Closes: Splunk integration tests are failing #23474

[thomasqueirozb]

/ci-run-integration-splunk

[datadog-vectordotdev]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 56d2f9c | Docs | Give us feedback!}

[thomasqueirozb]

/ci-run-integration-splunk

[thomasqueirozb]

/ci-run-integration-splunk

[pront]

Nice fix 👍

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 56d2f9c4f7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Wait for Splunk health before re-enabling the job

In the inspected CI path, scripts/run-integration-test.sh runs vdev ... start and then immediately vdev ... test, while Compose::start invokes Docker Compose as up --detach without --wait. Docker documents --wait as “Wait for services to be running|healthy”, so this new healthcheck is never used to block test execution; when Splunk is still booting past the helper's 60s token retry, the re-enabled Splunk integration job can still fail against a starting container. Please make the runner wait on health, or poll this endpoint before launching the tests.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep shared tests on the non-ack HEC token

With this corrected mount, data/default.yml is now applied and adds the ack-token input with useACK: true, but the shared log and metric test configs still call get_token() and take the first token returned by Splunk; this patch only pins the non-ack token in one test even though the new comment notes ACK_TOKEN can be returned first. When that happens, ordinary sink tests unexpectedly exercise indexer acknowledgements with the 10s default query interval, making the re-enabled Splunk suite slow or flaky. Pin the common test configs to DEFAULT_TOKEN or select the intended token by name.

Useful? React with 👍 / 👎.