All Apps and Add-ons

Event Hubs - JSON data and limiting data.


I'm using the Microsoft Azure add on for splunk to read from event hub in Azure.   I am using Splunk cloud and a heavy fowarder in Azure.

Two Problems,

1st.    The data showing up is one big field of JSON.  I've tried to extract in splunk cloud, but its getting mangled.

2nd.  Can i limit this.  75% of my fields are useless and and taking up space.

Can anyone help me out with either issue?

I am using a heavy fwd'r.    Splunk support does tell me to use spath.   But how do i do this in parsing event hub data?   Do i need  different addon?

Labels (2)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>