All Apps and Add-ons

Microsoft for Cloud Services Add-on is not working with Event Hub

New Member

We setup an Azure Event Hub to send logs to Splunk. We installed the Microsoft for Cloud Services add-on. We created an Azure Account and gave it a Reader role with Azure Event Hubs Data Receiver assigned as well. We then link that account in Splunk. We created a new Event Hub input in Splunk Cloud v8.2.2112.1. In Azure, we can the Event Hub is sending messages, but they're not being received into Splunk. First question is, what the roles necessary for the Azure Account for this to work correctly? Second question, I see in documentation and other sites people are using the connection string. But our window asks for the FQDN. We tried both, and neither work. Is there a specific format we have to use for the Event Hub Namespace (FQDN)? Finally, is there a query we can run in Splunk to search for errors associated with the Event Hub input? I tried to search using the SourceType in the Event Hub input and no logs are returned.

Labels (4)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>