All Apps and Add-ons

Azure Log Analytics Kusto (KQL) Grabber inconsistant.

Path Finder

I have two questions for anyone who might be using this add on.

1) We have a variety of kusto queries and by and large they have been ok.  In one case though we find one that seems to only be activating every so often when it feels like it.  All the rest are fine and all of them, including this bad one, use the same interval.  I mean you can see they are all the same as its a column when looking over the inputs area.  Im wondering if anyone has ever encountered this behavior and if so if anything fixed it.  Its funny too because I was somewhat concerned about us hitting some limit on log analytics or some such but I have setup some more and they are essentially fine.

2) Our queries are setup to grab the last minute every minute.  I notice we seem to miss some data and my theory is I need to overlap to deal with latencies in the query itself.  The absolute worst query I saw took into the teens to do so I was thinking of grabbing the last 80 seconds every 60 seconds.  Im a little concerned though how splunk might handle that.  Will it recognize input that is exactly the same as recieved before and deduplicate or will we be pushing a bunch of duplicates?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...