Azure Monitor Metrics in event hub but not appearing in Splunk

[devsupport]

We configured the Azure Monitor Metrics input and configured diagnostics to send metrics (and logs) to our event hub. We are only seeing 2 amm_resourceTypes when there should be more (ex. Load Balancer). Using Service Bus Explorer, we can see expected metrics data in the event hub.

After reading through the docs on GitHub, I do not see any additional configuration required to pull other Azure resource type metrics. Should the add-on automatically handle all/most resource types?

We're using add-on version 1.3.1.

[jconger · Accepted solution]

The Metrics input in the Azure Monitor Ad-on uses a REST API to get the metrics data rather than event hubs (the Activity input and the Diagnostic input do use event hubs though). There are 2 parts to the metrics input:

1. Configure the input in Splunk (tenant ID, app ID/key, subscription ID, vault information).
2. Tag the resource(s) you want with a "metrics" tag. The value of the tag should be the metric(s) you want to collect. More information here -> https://github.com/Microsoft/AzureMonitorAddonForSplunk/wiki/Configuration-of-Azure#metrics

Here is a good reference on the metics available from Azure Monitor that can be ingested into Splunk -> https://docs.microsoft.com/en-us/azure/azure-monitor/platform/metrics-supported