Data Parsing Issue - Ingesting The Logs Using Splunk Add-On For Microsoft Cloud Services

[anandhalagaras1]

Hi All,

We initially received a requirement to configure and ingest logs from Azure Storage Blob. To address this, we installed the Splunk Add-On for Microsoft Cloud Services on our Heavy Forwarder servers and configured it to pull logs from Azure Storage Blob using the Azure Storage Account.

Currently, there's a new requirement to ingest Databricks logs from Azure Storage Blob. We completed the necessary configurations and set the default sourcetype to mscs:storage:blob for data parsing. While the events are visible in Splunk after the configuration, we noticed that the data parsing is not functioning as expected for these events.

As a troubleshooting step, I changed the sourcetype to mscs:storage:blob:json, but the issue still persists.

Could you please assist me in resolving this issue? Your guidance would be greatly appreciated.

[rishabhshah]

Could you please share the sample raw logs and how are those looking in Splunk once they are ingested? Issues with Line breaking, timestamp assignment, field extraction?

[kiran_panchavat]

@anandhalagaras1 

Have you checked this community page?

https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Microsoft-Cloud-Services-How-... 

[anandhalagaras1]

@kiran_panchavat ,

I have tried the same as per the community page but still its the same the data are not getting parsed.

[anandhalagaras1]

Can anyone help on my request.