All Apps and Add-ons

Azure Add-on doesn't get past initialization

gordo32
Communicator

I've configured the Azure Add-on (2.0) on Splunk Enterprise 8.0.2, but it doesn't appear to be getting past initialization. In debug mode, I just get:

2020-03-14 00:00:16,223 INFO pid=1832 tid=MainThread file=connectionpool.py:new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2020-03-14 00:00:16,917 INFO pid=1832 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2020-03-14 00:00:17,504 INFO pid=1832 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2020-03-14 00:00:18,467 INFO pid=1832 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2020-03-14 00:00:19,477 DEBUG pid=1832 tid=MainThread file=base_modinput.py:log_debug:286 | _Splunk
Getting proxy server.
2020-03-14 00:00:19,478 INFO pid=1832 tid=MainThread file=setup_util.py:log_info:114 | Proxy is not enabled!
2020-03-14 00:00:19,478 INFO pid=1832 tid=MainThread file=client_abstract.py:init:161 | u'eventhub.pysdk-ea3d48b9': Created the Event Hub client
2020-03-14 00:00:19,478 DEBUG pid=1832 tid=MainThread file=message.py:init:109 | Deallocating 'AMQPValue'
2020-03-14 00:00:19,479 DEBUG pid=1832 tid=MainThread file=message.py:init:109 | Destroying 'AMQPValue'
2020-03-14 00:00:19,480 DEBUG pid=1832 tid=MainThread file=client.py:open:234 | Opening client connection.
2020-03-14 00:00:19,480 DEBUG pid=1832 tid=MainThread file=init.py:initialize:157 | Initializing platform.
...lather, rinse, repeat...

Nothing in python.log either.

I configured my connection string as: Endpoint=sb://.servicebus.windows.net/;ShareAccessKeyName=RootManageShareAccessKey;SharedAccessKey=

Event Hub Name:
adlogs

Index:
eventhub

All other settings are defaults.

I've gone through the Azure config and all looks good as well. Any ideas why it would stop after "initializing platform" with no errors and then just restart on the next interval?

jawaharas
Motivator

As per Microsoft Azure Add on for Splunk's documentation, the add-on is compatible to below versions. When I tried the add-on (EventHub data-input) in Splunk Enterprise 7.2.9.1, its works.

COMPATIBILITY:
Products: Splunk Enterprise, Splunk Cloud
Splunk Versions: 7.3, 7.2, 7.1, 7.0

jawaharas
Motivator

Same here. Any assistance will be helpful.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Ditch the Manual Grind: Building AI Agents with Splunk

Ditch the Manual Grind: Building AI Agents with Splunk Let’s be real: your team’s time is being eaten alive. ...

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...