All Apps and Add-ons

Microsoft for Cloud Services Add-on is not working with Event Hub

jwood_insight
New Member

We setup an Azure Event Hub to send logs to Splunk. We installed the Microsoft for Cloud Services add-on. We created an Azure Account and gave it a Reader role with Azure Event Hubs Data Receiver assigned as well. We then link that account in Splunk. We created a new Event Hub input in Splunk Cloud v8.2.2112.1. In Azure, we can the Event Hub is sending messages, but they're not being received into Splunk. First question is, what the roles necessary for the Azure Account for this to work correctly? Second question, I see in documentation and other sites people are using the connection string. But our window asks for the FQDN. We tried both, and neither work. Is there a specific format we have to use for the Event Hub Namespace (FQDN)? Finally, is there a query we can run in Splunk to search for errors associated with the Event Hub input? I tried to search using the SourceType in the Event Hub input and no logs are returned.

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...