We setup an Azure Event Hub to send logs to Splunk. We installed the Microsoft for Cloud Services add-on. We created an Azure Account and gave it a Reader role with Azure Event Hubs Data Receiver assigned as well. We then link that account in Splunk. We created a new Event Hub input in Splunk Cloud v8.2.2112.1. In Azure, we can the Event Hub is sending messages, but they're not being received into Splunk. First question is, what the roles necessary for the Azure Account for this to work correctly? Second question, I see in documentation and other sites people are using the connection string. But our window asks for the FQDN. We tried both, and neither work. Is there a specific format we have to use for the Event Hub Namespace (FQDN)? Finally, is there a query we can run in Splunk to search for errors associated with the Event Hub input? I tried to search using the SourceType in the Event Hub input and no logs are returned.
