Get data from Azure Function into Splunk Enterprise

jeffbat — Mon, 16 Nov 2020 17:05:26 GMT

I am trying to be able to get data in from an azure function one our of team's has done.

We are not able to get the data in through our HEC endpoints as all of those are internal to our network and the azure function sits outside of our network. So we have gone the route of trying to have the function send into an EventHub in Azure and then we pull the data from there.

using the Microsoft Azure Add-on for Splunk:

https://splunkbase.splunk.com/app/3757/

But it only seems to like the standard Azure diagnostic type logged data (admin/metrics). But not any custom error logging we are sending into that EventHub.

I am not seeing any errors for the app saying it can't connect or anything but no luck getting the custom erro logs.

What is the best way to get an applications custom error logs out of an Azure EventHub?

topic Get data from Azure Function into Splunk Enterprise in Getting Data In

Get data from Azure Function into Splunk Enterprise