https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-Splunk-from-Azure-Event-Hub/m-p/618022#M106652 <P>Hello there!</P> <P>I've been ingesting data from Azure Storage Explorer via the Splunk Add-On for Microsoft Cloud Services app, however, I now wish to ingest data from an Azure Event Hub.&nbsp;</P> <P>I know I can either create an input in the same app or use the Microsoft Azure Add-on for Splunk app.&nbsp; Is there a way to specify which partition to collect data from?&nbsp; Furthermore, is there a way to send data to different indexes and sourcetypes from 1 Event Hub?</P> <P>I'm working on Splunk Cloud, so I currently don't have access to config files.</P> <P>Thanks in advance!</P> Fri, 21 Oct 2022 19:54:52 GMT pcontreras 2022-10-21T19:54:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-Splunk-from-Azure-Event-Hub/m-p/618022#M106652 <P>Hello there!</P> <P>I've been ingesting data from Azure Storage Explorer via the Splunk Add-On for Microsoft Cloud Services app, however, I now wish to ingest data from an Azure Event Hub.&nbsp;</P> <P>I know I can either create an input in the same app or use the Microsoft Azure Add-on for Splunk app.&nbsp; Is there a way to specify which partition to collect data from?&nbsp; Furthermore, is there a way to send data to different indexes and sourcetypes from 1 Event Hub?</P> <P>I'm working on Splunk Cloud, so I currently don't have access to config files.</P> <P>Thanks in advance!</P> Fri, 21 Oct 2022 19:54:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-Splunk-from-Azure-Event-Hub/m-p/618022#M106652 pcontreras 2022-10-21T19:54:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-Splunk-from-Azure-Event-Hub/m-p/618914#M106753 <P>if you're familiar with Azure Logic Apps, you could consider using those to get events from the Event Hub and push them to a Splunk HEC input. The logic app can then also contain some logic to assign different index/sourcetype etc. to the data (as part of the HEC metadata fields).</P><P>I just noticed someone also built a Splunk App around that approach:&nbsp;<A href="https://splunkbase.splunk.com/app/6223" target="_blank">https://splunkbase.splunk.com/app/6223</A></P> Mon, 31 Oct 2022 13:00:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-Splunk-from-Azure-Event-Hub/m-p/618914#M106753 FrankVl 2022-10-31T13:00:05Z