All Apps and Add-ons

How to ingest Event Hubs with Microsoft Cloud Services?


Im using the Splunk Add-on for Microsoft Cloud Services, and I'm trying to ingest EHs.
We've setup th SP, and Enterprise app, created EHs. and configured account and inputs in addon

yyyy-dd-mm 11:36:20,813 level=INFO pid=18561 tid=MainThread logger=__main__ datainput="AzureEH" start_time= message="Blob checkpoint store not configured"
yyyy-dd-mm 11:36:14,786 level=INFO pid=18427 tid=MainThread logger=splunksdc.loop datainput="AzureEH" start_time= message="Loop has been aborted."
Labels (3)
0 Karma


Answering my own question. At was resolved with correct permission in azure

0 Karma


I encounter the exact same issue. What permissions do you exactly mean?

0 Karma


You require two permissions to ingest Event Hub through through Microsoft Cloud Services.

- Azure Service Management -> "user_impersonation"

- In Azure Portal -> Subscriptions -> Access control (IAM) -> Add role assignments -> Role: "Azure Event Hubs Data Receiver" -> User, group or service principal -> give this your app.

It has been documented meanwhile at


what Permission did you add to fix this ? 

0 Karma

Loves-to-Learn Everything

What permissions was this? Event Hub Data Receiver? 

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...