All Apps and Add-ons

Splunk Add-on for Microsoft Cloud Services - What can event_format_flags be used for?

Tasos
Engager

I am trying to undesrtand what the option event_format_flags in  inputs.conf  file can be used for.[mscs_azure_event_hub://<name>]
event_format_flags = <integer> The bitwise flags that determines the format of output events

Labels (1)

youngec
Explorer

There seems to no longer be any mention of event_format_flags in the latest app upgrade documentation as of the release of v4.5.1.  So maybe this is no longer necessary in the updated app.

Upgrade the Splunk Add-on for Microsoft Cloud Services - Splunk Documentation

0 Karma

ivarny
Path Finder

Anyone?  We are getting json formatted data that is garbeld now via the Microsoft-Cloud-Services app.

It was formatted correctly via the AAD app.

Now there is extra " " around the json and additional \" around each key. 

0 Karma

Ankit_kiraula
Explorer

Hey, were you able to find the resolution on this?

0 Karma

ivarny
Path Finder

Nope, I think I ended up with using sed in props to remove the offending " ".

0 Karma

Ankit_kiraula
Explorer

can you share the props or SEDCMD you are using right now?

0 Karma

ivarny
Path Finder

Sure, it seems it was only needed for a particular eventhub, and there I am running:

SEDCMD-remove_quot_infront= s/^\"{/{/g

SEDCMD-remove_quot_behind = s/}\"$/}/g

SEDCMD-remove_slash = s/\\"/"/g

0 Karma

Ankit_kiraula
Explorer

Yea, smae same but different.

 

yesterday i applied this  and it started working too.

s/(\\")/"/g
 
on the data but now i do not see it in the sourcetype advance option, if i add it again the log quality will ruin again. so not sure how the TA messed up.
0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...