topic Data Parsing Issue - Ingesting The Logs Using Splunk Add-On For Microsoft Cloud Services in All Apps and Add-ons

Data Parsing Issue - Ingesting The Logs Using Splunk Add-On For Microsoft Cloud Services

anandhalagaras1 — Thu, 26 Dec 2024 13:07:55 GMT

Hi All,

We initially received a requirement to configure and ingest logs from Azure Storage Blob. To address this, we installed the Splunk Add-On for Microsoft Cloud Services on our Heavy Forwarder servers and configured it to pull logs from Azure Storage Blob using the Azure Storage Account.

Currently, there's a new requirement to ingest Databricks logs from Azure Storage Blob. We completed the necessary configurations and set the default sourcetype to mscs:storage:blob for data parsing. While the events are visible in Splunk after the configuration, we noticed that the data parsing is not functioning as expected for these events.

As a troubleshooting step, I changed the sourcetype to mscs:storage:blob:json, but the issue still persists.

Could you please assist me in resolving this issue? Your guidance would be greatly appreciated.

Re: Data Parsing Issue - Ingesting The Logs Using Splunk Add-On For Microsoft Cloud Services

anandhalagaras1 — Thu, 02 Jan 2025 08:05:27 GMT

Can anyone help on my request.

Re: Data Parsing Issue - Ingesting The Logs Using Splunk Add-On For Microsoft Cloud Services

kiran_panchavat — Thu, 02 Jan 2025 10:16:11 GMT

@anandhalagaras1

Have you checked this community page?

https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Microsoft-Cloud-Services-How-to-edit-props/m-p/242367

Re: Data Parsing Issue - Ingesting The Logs Using Splunk Add-On For Microsoft Cloud Services

anandhalagaras1 — Thu, 02 Jan 2025 11:58:24 GMT

@kiran_panchavat ,

I have tried the same as per the community page but still its the same the data are not getting parsed.

Re: Data Parsing Issue - Ingesting The Logs Using Splunk Add-On For Microsoft Cloud Services

rishabhshah — Mon, 06 Jan 2025 13:41:58 GMT

Could you please share the sample raw logs and how are those looking in Splunk once they are ingested? Issues with Line breaking, timestamp assignment, field extraction?