All Apps and Add-ons

Microsoft Azure Add-on Error setting/pulling Event Hub

guarisma
Communicator

Hello,

I'm trying to integrate with Event Hub

I've entered my Connection String:

Endpoint=sb://<event-hub>.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=<shared-access-key>

And EventHub Name

But getting the following error that I'm not sure what it means

2019-10-30 15:11:50,000 ERROR pid=30610 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/modinput_wrapper/base_modinput.py", line 127, in stream_events
    self.collect_events(ew)
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure_event_hub.py", line 92, in collect_events
    input_module.collect_events(self, ew)
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/input_module_azure_event_hub.py", line 112, in collect_events
    partition_ids = client.get_partition_ids()
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 163, in get_partition_ids
    return self.get_properties()['partition_ids']
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 146, in get_properties
    response = self._management_request(mgmt_msg, op_type=b'com.microsoft:eventhub')
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 127, in _management_request
    self._handle_exception(exception, retry_count, max_retries)
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 105, in _handle_exception
    _handle_exception(exception, retry_count, max_retries, self)
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/error.py", line 196, in _handle_exception
    raise error
ConnectError: Unable to open management session. Please confirm URI namespace exists.
Unable to open management session. Please confirm URI namespace exists.

ariekh213
New Member

Similar problem here again , we have 1 RG with 2 "eventhubs" and private-endpoint for each eventhub .
we have openned ports 5671 / 5672 .

we have connected 1 eventhub to splunk and it works fine , when tried to connect the second it is not working and we get the following error :

2020-11-08 15:44:38,275 INFO pid=10482 tid=MainThread file=connection.py:_state_changed:177 | Connection '1442dad6-55e6-49bf-acc2-a8de23f2db1d' state changed from <ConnectionState.UNKNOWN: 999> to <ConnectionState.START: 0>

2020-11-08 15:44:38,293 INFO pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failure: getaddrinfo failure 66.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/socketio_berkeley.c':'lookup_address_and_initiate_socket_connection':283)

2020-11-08 15:44:38,293 INFO pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | 'lookup_address_and_connect_socket failed' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/socketio_berkeley.c':'socketio_open':766)

2020-11-08 15:44:38,293 INFO pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Closing tlsio from a state other than TLSIO_STATE_EXT_OPEN or TLSIO_STATE_EXT_ERROR'

2020-11-08 15:44:38,294 INFO pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Invalid tlsio_state. Expected state is TLSIO_STATE_OPENING_UNDERLYING_IO.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'on_underlying_io_open_complete':760)

2020-11-08 15:44:38,294 INFO pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening the underlying I/O.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'tlsio_openssl_open':1258)

2020-11-08 15:44:38,294 INFO pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | 'xio_open failed' ('/data/src/vendor/azure-uamqp-c/src/saslclientio.c':'saslclientio_open_async':1097)

2020-11-08 15:44:38,294 INFO pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Opening the underlying IO failed' ('/data/src/vendor/azure-uamqp-c/src/connection.c':'connection_open':1344)

2020-11-08 15:44:38,294 INFO pid=10482 tid=MainThread file=connection.py:_state_changed:177 | Connection '1442dad6-55e6-49bf-acc2-a8de23f2db1d' state changed from <ConnectionState.START: 0> to <ConnectionState.END: 13>

2020-11-08 15:44:38,294 INFO pid=10482 tid=MainThread file=connection.py:_state_changed:181 | Connection with ID '1442dad6-55e6-49bf-acc2-a8de23f2db1d' unexpectedly in an error state. Closing: False, Error: None

2020-11-08 15:44:38,295 INFO pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Begin session failed' ('/data/src/vendor/azure-uamqp-c/src/link.c':'link_attach':1154)

2020-11-08 15:44:38,295 INFO pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Link attach failed' ('/data/src/vendor/azure-uamqp-c/src/message_receiver.c':'messagereceiver_open':362)

2020-11-08 15:44:38,295 DEBUG pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | Management link open: 1

2020-11-08 15:44:38,295 INFO pid=10482 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening message receiver' ('/data/src/vendor/azure-uamqp-c/src/amqp_management.c':'amqp_management_open_async':981) .
both eventhubs are on the same vnet .

0 Karma

guarisma
Communicator

The problem was that TCP ports 5671 and 5672 were blocked from the Internal firewall out to the Internet.

“... data inputs use AMQP to connect to event hub over TLS using ports 5671 / 5672 as described in the AMQP 1.0 Service Bus and Event Hubs protocol guide. So, if you are having connection/authentication issues, check that these ports are open on your Splunk instance.”

The network administrator just allowed connections to these ports and the data started coming in!!

jconger
Splunk Employee
Splunk Employee

Great news - thanks for posting the solution for posterity!

pench2k19
Explorer

Hi @jconger 

I am still not able to get the success even after i follow all your troubleshooting steps, getting the following errors in splunk when i check with the different keywords.


08-10-2020 09:12:37.876 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_event_hub.py" response = self._management_request(mgmt_msg, op_type=b'com.microsoft:eventhub')

08-10-2020 09:12:37.905 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_event_hub.py" Unable to open management session. Please confirm URI namespace exists.

08-10-2020 09:12:37.876 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_event_hub.py" raise error

8-10-2020 09:12:37.876 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_event_hub.py" File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/error.py", line 196, in _handle_exception

08-10-2020 09:12:37.876 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_event_hub.py" _handle_exception(exception, retry_count, max_retries, self)

Could you please assist as this app is not supported by splunk. Thank you in advance.

0 Karma

pench2k19
Explorer

The actual errors are as following


2020-08-10 16:04:00,520 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Closing tlsio from a state other than TLSIO_STATE_EXT_OPEN or TLSIO_STATE_EXT_ERROR'
2020-08-10 16:04:00,519 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'wait_for_connection failed' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/socketio_berkeley.c':'socketio_open':770)
2020-08-10 16:04:00,519 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failure: select failure.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/socketio_berkeley.c':'wait_for_connection':370)
2020-08-10 16:03:50,453 INFO pid=19259 tid=MainThread file=connection.py:_state_changed:177 | Connection '88ceb760-92f6-4ee2-92d7-3013adb58efa' state changed from <ConnectionState.START: 0> to <ConnectionState.START: 0>
2020-08-10 16:03:50,452 INFO pid=19259 tid=MainThread file=connection.py:_close:136 | Connection shutdown complete '88bfa644-3d73-42f5-98af-bc38aa8173d7'.
2020-08-10 16:03:50,452 INFO pid=19259 tid=MainThread file=connection.py:_close:129 | Shutting down connection '88bfa644-3d73-42f5-98af-bc38aa8173d7'.
2020-08-10 16:03:50,452 INFO pid=19259 tid=MainThread file=error.py:_handle_exception:233 | u'eventhub.pysdk-c7722623' has an exception (AMQPConnectionError('Unable to open management session. Please confirm URI namespace exists.',)). Retrying...
2020-08-10 16:03:48,850 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening message receiver' ('/data/src/vendor/azure-uamqp-c/src/amqp_management.c':'amqp_management_open_async':981)
2020-08-10 16:03:48,850 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Link attach failed' ('/data/src/vendor/azure-uamqp-c/src/message_receiver.c':'messagereceiver_open':362)
2020-08-10 16:03:48,850 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Begin session failed' ('/data/src/vendor/azure-uamqp-c/src/link.c':'link_attach':1154)
2020-08-10 16:03:48,849 INFO pid=19259 tid=MainThread file=connection.py:_state_changed:181 | Connection with ID '88bfa644-3d73-42f5-98af-bc38aa8173d7' unexpectedly in an error state. Closing: False, Error: None
2020-08-10 16:03:48,849 INFO pid=19259 tid=MainThread file=connection.py:_state_changed:177 | Connection '88bfa644-3d73-42f5-98af-bc38aa8173d7' state changed from <ConnectionState.START: 0> to <ConnectionState.END: 13>
2020-08-10 16:03:48,849 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Opening the underlying IO failed' ('/data/src/vendor/azure-uamqp-c/src/connection.c':'connection_open':1344)
2020-08-10 16:03:48,849 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'xio_open failed' ('/data/src/vendor/azure-uamqp-c/src/saslclientio.c':'saslclientio_open_async':1097)
2020-08-10 16:03:48,849 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening the underlying I/O.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'tlsio_openssl_open':1258)
2020-08-10 16:03:48,849 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Invalid tlsio_state. Expected state is TLSIO_STATE_OPENING_UNDERLYING_IO.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'on_underlying_io_open_complete':760)
2020-08-10 16:03:48,848 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Closing tlsio from a state other than TLSIO_STATE_EXT_OPEN or TLSIO_STATE_EXT_ERROR'
2020-08-10 16:03:48,848 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'wait_for_connection failed' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/socketio_berkeley.c':'socketio_open':770)
2020-08-10 16:03:48,848 INFO pid=19259 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failure: select failure.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/socketio_berkeley.c':'wait_for_connection':370)
2020-08-10 16:03:38,781 INFO pid=19259 tid=MainThread file=connection.py:_state_changed:177 | Connection '88bfa644-3d73-42f5-98af-bc38aa8173d7' state changed from <ConnectionState.START: 0> to <ConnectionState.START: 0>

I have make sure the ports are opened,still no luck.

I have one question
Is event hub has to be separate for each resource group, we have created a event hub name space for one resource group and enabled the WAF logs for another resource group . Is that the problem here.

0 Karma

jconger
Splunk Employee
Splunk Employee

I've seen something similar where the event hub namespace was specified in the input instead of the event hub name.

alt text

0 Karma

guarisma
Communicator

I just noticed this Add-on is for Ubuntu or Darwin systems, what would I need for CentOS? Any particular Python libs?

0 Karma

jconger
Splunk Employee
Splunk Employee

The error is pointing to a namespace issue. I looked at your connection string, it it should be:

Endpoint=sb://<event-hub-namespace>.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=<shared-access-key>

0 Karma

guarisma
Communicator

That doesn't seem to be the problem 😞

Here are more errors from running index=_internal sourcetype="ta:ms:aad:log" source=*hub*

2019-10-30 15:54:47,997 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening message receiver' ('/data/src/vendor/azure-uamqp-c/src/amqp_management.c':'amqp_management_open_async':981)
2019-10-30 15:54:47,997 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Link attach failed' ('/data/src/vendor/azure-uamqp-c/src/message_receiver.c':'messagereceiver_open':362)
2019-10-30 15:54:47,997 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Begin session failed' ('/data/src/vendor/azure-uamqp-c/src/link.c':'link_attach':1154)
2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:181 | Connection with ID '8a0fbd26-fffa-4ace-993b-455aef8737bd' unexpectedly in an error state. Closing: False, Error: None
2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:177 | Connection '8a0fbd26-fffa-4ace-993b-455aef8737bd' state changed from <ConnectionState.START: 0> to <ConnectionState.END: 13>
2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Opening the underlying IO failed' ('/data/src/vendor/azure-uamqp-c/src/connection.c':'connection_open':1344)
2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'xio_open failed' ('/data/src/vendor/azure-uamqp-c/src/saslclientio.c':'saslclientio_open_async':1097)
2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening the underlying I/O.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'tlsio_openssl_open':1258)
2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Invalid tlsio_state. Expected state is TLSIO_STATE_OPENING_UNDERLYING_IO.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'on_underlying_io_open_complete':760)
2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Closing tlsio from a state other than TLSIO_STATE_EXT_OPEN or TLSIO_STATE_EXT_ERROR'
2019-10-30 15:54:47,995 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'wait_for_connection failed' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/socketio_berkeley.c':'socketio_open':770)
2019-10-30 15:54:47,989 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:177 | Connection '8a0fbd26-fffa-4ace-993b-455aef8737bd' state changed from <ConnectionState.START: 0> to <ConnectionState.START: 0>
2019-10-30 15:54:47,988 INFO pid=44249 tid=MainThread file=connection.py:_close:136 | Connection shutdown complete 'fda99a3d-6f6a-44d1-8921-8bf1d235fb95'.
2019-10-30 15:54:47,988 INFO pid=44249 tid=MainThread file=connection.py:_close:129 | Shutting down connection 'fda99a3d-6f6a-44d1-8921-8bf1d235fb95'.
2019-10-30 15:54:47,988 INFO pid=44249 tid=MainThread file=error.py:_handle_exception:233 | u'eventhub.pysdk-5ec316b9' has an exception (AMQPConnectionError('Unable to open management session. Please confirm URI namespace exists.',)). Retrying...
2019-10-30 15:54:47,187 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening message receiver' ('/data/src/vendor/azure-uamqp-c/src/amqp_management.c':'amqp_management_open_async':981)
2019-10-30 15:54:47,187 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Link attach failed' ('/data/src/vendor/azure-uamqp-c/src/message_receiver.c':'messagereceiver_open':362)
2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Begin session failed' ('/data/src/vendor/azure-uamqp-c/src/link.c':'link_attach':1154)
2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:181 | Connection with ID 'fda99a3d-6f6a-44d1-8921-8bf1d235fb95' unexpectedly in an error state. Closing: False, Error: None
2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:177 | Connection 'fda99a3d-6f6a-44d1-8921-8bf1d235fb95' state changed from <ConnectionState.START: 0> to <ConnectionState.END: 13>
2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Opening the underlying IO failed' ('/data/src/vendor/azure-uamqp-c/src/connection.c':'connection_open':1344)
2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'xio_open failed' ('/data/src/vendor/azure-uamqp-c/src/saslclientio.c':'saslclientio_open_async':1097)
2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening the underlying I/O.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'tlsio_openssl_open':1258)
2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Invalid tlsio_state. Expected state is TLSIO_STATE_OPENING_UNDERLYING_IO.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'on_underlying_io_open_complete':760)
2019-10-30 15:54:47,185 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Closing tlsio from a state other than TLSIO_STATE_EXT_OPEN or TLSIO_STATE_EXT_ERROR'
2019-10-30 15:54:47,185 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'wait_for_connection failed' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/socketio_berkeley.c':'socketio_open':770)
2019-10-30 15:54:47,178 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:177 | Connection 'fda99a3d-6f6a-44d1-8921-8bf1d235fb95' state changed from <ConnectionState.START: 0> to <ConnectionState.START: 0>
2019-10-30 15:54:47,176 INFO pid=44249 tid=MainThread file=client_abstract.py:__init__:161 | u'eventhub.pysdk-5ec316b9': Created the Event Hub client
2019-10-30 15:54:47,175 INFO pid=44249 tid=MainThread file=setup_util.py:log_info:114 | Proxy is not enabled!
2019-10-30 15:54:46,241 INFO pid=44249 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2019-10-30 15:54:45,295 INFO pid=44249 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2019-10-30 15:54:44,749 INFO pid=44249 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2019-10-30 15:54:44,068 INFO pid=44249 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2019-10-30 15:54:42,763 ERROR pid=44198 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/modinput_wrapper/base_modinput.py", line 127, in stream_events
    self.collect_events(ew)
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure_event_hub.py", line 92, in collect_events
    input_module.collect_events(self, ew)
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/input_module_azure_event_hub.py", line 112, in collect_events
    partition_ids = client.get_partition_ids()
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 163, in get_partition_ids
    return self.get_properties()['partition_ids']
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 146, in get_properties
    response = self._management_request(mgmt_msg, op_type=b'com.microsoft:eventhub')
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 127, in _management_request
    self._handle_exception(exception, retry_count, max_retries)
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 105, in _handle_exception
    _handle_exception(exception, retry_count, max_retries, self)
  File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/error.py", line 196, in _handle_exception
    raise error
ConnectError: Unable to open management session. Please confirm URI namespace exists.
Unable to open management session. Please confirm URI namespace exists.
2019-10-30 15:54:42,762 INFO pid=44198 tid=MainThread file=connection.py:_close:136 | Connection shutdown complete 'c0b76f33-cac3-44bc-b6b2-a7798c8d363f'.
2019-10-30 15:54:42,762 INFO pid=44198 tid=MainThread file=connection.py:_close:129 | Shutting down connection 'c0b76f33-cac3-44bc-b6b2-a7798c8d363f'.
0 Karma

rayar
Path Finder

HI

I am facing the same issue  , were you able to connect the Event Hub  ?

thanks 

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!