https://community.splunk.com/t5/Getting-Data-In/Eventhubs-Splunk-Add-ON-for-ms-cloud-services-partitions/m-p/544706#M90866 <P>I was using the MS Azure add-on for splunk.&nbsp; Trying to switch to Splunk Add-on for MS cloud services.&nbsp; &nbsp;One thing i noticed is that the event hub i was using is appending event hub events into the same splunk event.&nbsp;</P><P>&nbsp;Ie, instead of 8 events in Event Hub, and 8 events in splunk (which i saw in ms azure add-on for splunk),</P><P>I get 2 events of 4 body.records[].service_principal_name.&nbsp; &nbsp; The # of appended events is related to the # of partitiions, however, this thing doesn't seem to work w/ 1 partition.&nbsp; Keep getting can not find partition 0 of 0 when the eventhub is 1 partition.&nbsp; Formatting is TERRIBLE and it takes 30 seconds to render the 1st record in a search since raw so large.</P><P>Any ideas what's going on here?&nbsp; &nbsp;This supposed to be by design?</P> Mon, 22 Mar 2021 01:26:41 GMT zippo706 2021-03-22T01:26:41Z https://community.splunk.com/t5/Getting-Data-In/Eventhubs-Splunk-Add-ON-for-ms-cloud-services-partitions/m-p/544706#M90866 <P>I was using the MS Azure add-on for splunk.&nbsp; Trying to switch to Splunk Add-on for MS cloud services.&nbsp; &nbsp;One thing i noticed is that the event hub i was using is appending event hub events into the same splunk event.&nbsp;</P><P>&nbsp;Ie, instead of 8 events in Event Hub, and 8 events in splunk (which i saw in ms azure add-on for splunk),</P><P>I get 2 events of 4 body.records[].service_principal_name.&nbsp; &nbsp; The # of appended events is related to the # of partitiions, however, this thing doesn't seem to work w/ 1 partition.&nbsp; Keep getting can not find partition 0 of 0 when the eventhub is 1 partition.&nbsp; Formatting is TERRIBLE and it takes 30 seconds to render the 1st record in a search since raw so large.</P><P>Any ideas what's going on here?&nbsp; &nbsp;This supposed to be by design?</P> Mon, 22 Mar 2021 01:26:41 GMT https://community.splunk.com/t5/Getting-Data-In/Eventhubs-Splunk-Add-ON-for-ms-cloud-services-partitions/m-p/544706#M90866 zippo706 2021-03-22T01:26:41Z