All Apps and Add-ons

Error when ingesting Azure Activity Log: No connection on hub: insights-operational-logs.

Communicator

After configuring Azure Monitor Add-On in Splunk and Azure, I receive the following error from splunkd:

ERROR ExecProcessor - message from "/opt/splunk/etc/apps/TA-Azure_Monitor/bin/azure_activity_log.sh" Modular input azure_activity_log:// No connection on hub: insights-operational-logs. Is there a network route to the endpoint?

I am using Splunk's proxy variable to send traffic through our Squid proxy. Is this compatible with the add-on?

Nothing is getting denied in the proxy - I'm allowing access to login.microsoftonline.com and .vault.azure.net. Python and Nodejs dependencies have been installed as well.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

This add-on does not support a proxy server directly. The add-on uses AMQP to connect to the Azure event hubs for activity data and diagnostic logs, so setting the HTTP proxy in server.conf doesn't help. Some people have either run the add-on inside of Azure via a heavy forwarder on an Azure VM, or have a heavy forwarder that doesn't need a proxy for an outbound connection.

View solution in original post

Splunk Employee
Splunk Employee

This add-on does not support a proxy server directly. The add-on uses AMQP to connect to the Azure event hubs for activity data and diagnostic logs, so setting the HTTP proxy in server.conf doesn't help. Some people have either run the add-on inside of Azure via a heavy forwarder on an Azure VM, or have a heavy forwarder that doesn't need a proxy for an outbound connection.

View solution in original post

Communicator

Thank you, jconger. I'll give it a try without the proxy and report back.

0 Karma

Communicator

That was it! Thank you, jconger!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!