https://community.splunk.com/t5/Getting-Data-In/Tuning-Configuration-Event-Hub-in-Microsoft-Cloud-Services-App/m-p/688477#M114663 <P>Hi,&nbsp;<BR /><BR />I am having some trouble understanding the right configuration for collecting the Logs from the Event Hub of the App "Microsoft Cloud Services".&nbsp;<BR />From the documentation: <A href="https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Configureeventhubs/" target="_self">Configure Event Hubs</A>&nbsp; it is not clear how to set these three parameters for a Log Source that collect A LOT of logs every minute.&nbsp;<BR /><BR /><STRONG>interval --&gt;&nbsp; The number of seconds to wait before the Splunk platform runs the command again. The default is 3600 seconds.</STRONG><BR />There is a way in the _internal logs to check when the command is executed?&nbsp;<BR /><BR /><STRONG>max_batch_size --&gt; The maximum number of events to retrieve in one batch. The default is 300.</STRONG><BR />This is pretty clear, but can we increase this value as much as we want? I believe we encounter some performance issue on that.&nbsp;<BR /><BR /><STRONG>max_wait_time --&gt;&nbsp; The maximum interval in seconds that the event processor will wait before processing. The default is 300 seconds.</STRONG><BR />Processing what? Waiting for what?<BR /><BR /><BR />Anyone know a configuration of values between these three fields that could optimize an Event Hub with thousands and thousands of Logs ??</P> Thu, 23 May 2024 14:34:01 GMT dc17 2024-05-23T14:34:01Z https://community.splunk.com/t5/Getting-Data-In/Tuning-Configuration-Event-Hub-in-Microsoft-Cloud-Services-App/m-p/688477#M114663 <P>Hi,&nbsp;<BR /><BR />I am having some trouble understanding the right configuration for collecting the Logs from the Event Hub of the App "Microsoft Cloud Services".&nbsp;<BR />From the documentation: <A href="https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Configureeventhubs/" target="_self">Configure Event Hubs</A>&nbsp; it is not clear how to set these three parameters for a Log Source that collect A LOT of logs every minute.&nbsp;<BR /><BR /><STRONG>interval --&gt;&nbsp; The number of seconds to wait before the Splunk platform runs the command again. The default is 3600 seconds.</STRONG><BR />There is a way in the _internal logs to check when the command is executed?&nbsp;<BR /><BR /><STRONG>max_batch_size --&gt; The maximum number of events to retrieve in one batch. The default is 300.</STRONG><BR />This is pretty clear, but can we increase this value as much as we want? I believe we encounter some performance issue on that.&nbsp;<BR /><BR /><STRONG>max_wait_time --&gt;&nbsp; The maximum interval in seconds that the event processor will wait before processing. The default is 300 seconds.</STRONG><BR />Processing what? Waiting for what?<BR /><BR /><BR />Anyone know a configuration of values between these three fields that could optimize an Event Hub with thousands and thousands of Logs ??</P> Thu, 23 May 2024 14:34:01 GMT https://community.splunk.com/t5/Getting-Data-In/Tuning-Configuration-Event-Hub-in-Microsoft-Cloud-Services-App/m-p/688477#M114663 dc17 2024-05-23T14:34:01Z