Microsoft Log Analytics Add-On - Optimize Inputs

maxhan6 — Tue, 19 Jan 2021 21:03:34 GMT

Currently, we are utilizing the Log Analytics TA for ingesting Azure SQL data into Splunk. Although the data is being ingested, we do come across situations where the data ingestion stops. In order to fix the issue, we have a manual workaround where we disable and then enable inputs. Based on the parameters provided ...

[log_analytics://AZURESQL_CONNECT]
resource_group = <resource_group>
workspace_id = <workspace_id>
subscription_id = <subscription_id>
tenant_id = <tenant_id>
application_id = <application_id>
application_key = ********
log_analytics_query = AzureDiagnostics | where ResourceProvider == 'MICROSOFT.SQL' | where ResourceGroup contains 'CONNECT' | where Category == 'SQLSecurityAuditEvents'
start_date = 07/10/2020 09:00:00
event_delay_lag_time = 10
index = <index>
interval = 300
sourcetype = <sourcetype>

Is there a good way to optimize the inputs for consistent data ingestion? Any advice or suggestions would be appreciated. Thanks.

Regards,
Max

Re: Microsoft Log Analytics Add-On - Optimize Inputs

k_cummins — Wed, 29 Nov 2023 11:27:13 GMT

Here is the suggestion for best performance with no issues for your case.

https://splunkbase.splunk.com/app/7130

Give me a like if that solves yours

https://splunkbase.splunk.com/app/7130

topic Microsoft Log Analytics Add-On - Optimize Inputs in Getting Data In

Microsoft Log Analytics Add-On - Optimize Inputs

Re: Microsoft Log Analytics Add-On - Optimize Inputs