We ran the EventHub integration on HF , after some time we want to move the App to another HF
How I can configure start time in order to avoid duplicates
[splunk@ilissplfwd11 local]$ cat inputs.conf
[mscs_azure_event_hub://amdocsazureadlogs]
account = splunk
consumer_group = $Default
event_hub_name = eventhub-name
event_hub_namespace = eventhub-name.servicebus.windows.net
index = amdocsazureadlogs
interval = 15
max_batch_size = 3000
max_wait_time = 10
sourcetype = mscs:azure:eventhub
use_amqp_over_websocket = 1
[splunk@ilissplfwd11 local]$
what will be the best configuration to handle a big amount of data (interval/max_batch_size etc)
Could you please check if you can find any checkpoint file under
$SPLUNK_HOME/var/lib/splunk/modinputs/mscs_azure_event_hub/
If yes that file/these files must be copied to your new HF and the naming must match.
thanks , it worked for me
how I can improve the performance , I have a 24H gap now
the HF is running this integration only
[mscs_azure_event_hub://eventhub]
account = splunk
consumer_group = $Default
event_hub_name = eventhub
event_hub_namespace = eventhub.servicebus.windows.net
index = amdocsazureadlogs
interval = 30
max_batch_size = 2000
max_wait_time = 10
sourcetype = mscs:azure:eventhub
use_amqp_over_websocket = 1
disabled = 0