All Apps and Add-ons

Splunk Add-On for Microsoft Cloud Services - How to fix Eventhub input parsing error of JSON?



We've set up an Eventhub input using the Splunk Add-on for MS Cloud Services, and we are getting events successfully into Splunk.

The problem is that the events are not formatted correctly when indexed into Splunk. 
JSON formatted events are indexed into Splunk with all the quotation marks escaped. This messes up the syntax highlighting, and the auto field extractions.

The sourcetype used during eventhub config is mscs:azure:eventhub, as per the docs states.

The following code is used to generate test data, and the rendered result is in the screenshot. 

Anyone seen the same, or resolved it somehow?


#Method 1 - You provide a JSON string
body1 = "{'id':'device2','goo':'frodo'}"

#Method 2 - You get the JSON Object and convert to string
json_obj = {"id": "device3", "goo": "bilbo"}
body2 = json.dumps(json_obj)

#This just sending the string which will not be captured by TSI
event_data_batch.add(EventData('Third event'))





Labels (3)
0 Karma
1 Solution

0 Karma


add event_format_flags = 1  to your inputs as per documentation

0 Karma


As an added input:
I've used the Eventhub integration to collect events with proper json rendering earlier, but then the data source was Microsofts own streaming options to Eventhub, e.g.  Stream Microsoft Defender for Endpoint events to Azure Event Hubs | Microsoft Learn

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...