topic Re: TA-Azure data inputs configuration in Getting Data In

TA-Azure data inputs configuration

pkeller — Thu, 04 Aug 2016 15:08:31 GMT

The instructions for configuring data inputs for the TA-Azure imply that there should be additional items under Settings -> Data Inputs. We're not seeing them. We've installed and enabled the TA but can't proceed with the highlighted step (below) from the documentation because neither "Azure Diagnostics" nor "Azure Website Diagnostics" input appears in standard Data Inputs panel.

[ snipped from Azure setup document ]

Setting up Splunk to read Azure diagnostic logs

Within Splunk, click Settings -> Data inputs

Click the "Azure Diagnostics" input or "Azure Website Diagnostics" input

Click on the "New" button to create a new data input
Give the input a unique name
Supply the name of the Azure Storage account containing the log data
Supply the Azure Storage account access key - refer to the section below for details on how to obtain your storage account access key

Is there some other setup item that needs to be performed in order to complete the Data inputs portion for the Azure TA?

Re: TA-Azure data inputs configuration

jconger — Thu, 04 Aug 2016 15:10:35 GMT

What version of Splunk are you running and what other inputs do you see?

Re: TA-Azure data inputs configuration

pkeller — Thu, 04 Aug 2016 15:17:20 GMT

Thank you ... Running 6.4.0 and we see the standard 5 items

Files & directories
TCP
UDP
Scripts
Database inputs

Re: TA-Azure data inputs configuration

pkeller — Thu, 04 Aug 2016 22:01:53 GMT

I've been working on this most of the day and this is what I found.

Installing the TA on a 6.4.2 system ( upgraded from 6.3.2 ) results in no modifications to the "Settings -> Data Inputs" panel.

In addition, the blog http://blogs.splunk.com/tag/azure/ suggests that we should be seeing a "Local Inputs" header under "Settings -> Data Inputs" ... That's not the case in any of our 6.4.x 'upgraded' infrastructure.

After doing a fresh install of 6.4.2, I now see the "Local Inputs" and Forwarded Inputs headers under "Settings -> Data Inputs" ... I believe that somewhere in the upgrade process, the migration steps performed must have missed the changes required here.

Re: TA-Azure data inputs configuration

pkeller — Fri, 05 Aug 2016 15:41:55 GMT

I believe my issue was that the "SplunkLightForwarder" app had been enabled on this host. ( SplunkForwarder was also enabled ) ... I disabled the app, restarted Splunk, and now the Data Inputs panel looks the way it is described in the documentation.

Re: TA-Azure data inputs configuration

pkeller — Tue, 29 Sep 2020 10:29:21 GMT

Ultimately, this was caused because the dbConnect app (v 1.x) contains a datainputstats.html file which was taking precedence over the 6.4.x file with the same name under $SPLUNK_HOME/share/splunk/search_mrsparkle/templates/admin/datainputstats.html

I replaced the html file under the dbx tree with the one from search_mrsparkle, bounced splunkd and all looks good now.