All Apps and Add-ons

Microsoft Azure Add-on for Splunk: Why isn't data coming in using event hub input only (is account info required for configuration)?

tvanry
Engager

If we are only adding an event hub input using the Microsoft Azure Add-on for Splunk, do we need to include account information on the configuration tab?

We haven't put in any account information on the configuration tab and are only using an event hub input, but we aren't seeing any data coming in.

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

You do not need the account information for the Event Hub input. The account information is necessary for the other inputs as they use REST APIs, and the account is used to authenticate to those APIs. The Event Hub input only needs the connection string (no account).

View solution in original post

jconger
Splunk Employee
Splunk Employee

You do not need the account information for the Event Hub input. The account information is necessary for the other inputs as they use REST APIs, and the account is used to authenticate to those APIs. The Event Hub input only needs the connection string (no account).

View solution in original post

tvanry
Engager

Any other places to check as to why we are not seeing data come in to Splunk?

0 Karma

jconger
Splunk Employee
Splunk Employee

Here are the 3 most common issues:

  • Using a Splunk 8 instance - the Event Hub input does not work on Splunk 8 (yet)
  • Entering an Event Hub key instead of an Event Hub connection string

alt text

  • Entering an Event Hub Namespace instead of an individual Event Hub Name

alt text

0 Karma

tvanry
Engager

Thanks Jason. It appears that our problem might be firewall related.

0 Karma

tvanry
Engager

Confirmed that this all works after the firewall was opened up. We had to open our heavy forwarder to be able to reach port 5671.

0 Karma

rluhar_fs
Explorer

What is your splunk version? I am having issue but my splunk is also in Azure and I am on 8.0.3 version.

0 Karma

tvanry
Engager

Our Splunk version is 7.2.7. The event hub collector is not compatible with Splunk 8. See @jconger response above.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!