How I can configure start time in order to avoid duplicates?

[rayar]

We ran the EventHub integration  on HF , after some time we want to move the App to another HF 

How I can configure start time in order to avoid duplicates 

[splunk@ilissplfwd11 local]$ cat inputs.conf
[mscs_azure_event_hub://amdocsazureadlogs]
account = splunk
consumer_group = $Default
event_hub_name = eventhub-name
event_hub_namespace = eventhub-name.servicebus.windows.net
index = amdocsazureadlogs
interval = 15
max_batch_size = 3000
max_wait_time = 10
sourcetype = mscs:azure:eventhub
use_amqp_over_websocket = 1
[splunk@ilissplfwd11 local]$

what will be the best configuration to handle a big amount of data  (interval/max_batch_size etc) 

[PaulPanther]

Could you please check if you can find any checkpoint file under 

$SPLUNK_HOME/var/lib/splunk/modinputs/mscs_azure_event_hub/

If yes that file/these files must be copied to your new HF and the naming must match.  

[rayar]

thanks , it worked for me 

how I can improve the performance , I have a 24H gap now

the HF is running this integration only 

[mscs_azure_event_hub://eventhub]
account = splunk
consumer_group = $Default
event_hub_name = eventhub
event_hub_namespace = eventhub.servicebus.windows.net
index = amdocsazureadlogs
interval = 30
max_batch_size = 2000
max_wait_time = 10
sourcetype = mscs:azure:eventhub
use_amqp_over_websocket = 1
disabled = 0

[rayar]

Hi

Please advise how we can improve the performance

the gap is now 36 hours