All Apps and Add-ons
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Event Hubs - JSON data and limiting data.

zippo706
Explorer
‎08-24-2020 02:52 PM

I'm using the Microsoft Azure add on for splunk to read from event hub in Azure.   I am using Splunk cloud and a heavy fowarder in Azure.

Two Problems,

1st.    The data showing up is one big field of JSON.  I've tried to extract in splunk cloud, but its getting mangled.

2nd.  Can i limit this.  75% of my fields are useless and and taking up space.

Can anyone help me out with either issue?

I am using a heavy fwd'r.    Splunk support does tell me to use spath.   But how do i do this in parsing event hub data?   Do i need  different addon?

Labels (2)
Labels
0 Karma
Reply
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...