- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Add-on for Microsoft Cloud Services - What can event_format_flags be used for?
I am trying to undesrtand what the option event_format_flags in inputs.conf file can be used for.[mscs_azure_event_hub://<name>]
event_format_flags = <integer> The bitwise flags that determines the format of output events
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There seems to no longer be any mention of event_format_flags in the latest app upgrade documentation as of the release of v4.5.1. So maybe this is no longer necessary in the updated app.
Upgrade the Splunk Add-on for Microsoft Cloud Services - Splunk Documentation
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Anyone? We are getting json formatted data that is garbeld now via the Microsoft-Cloud-Services app.
It was formatted correctly via the AAD app.
Now there is extra " " around the json and additional \" around each key.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey, were you able to find the resolution on this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nope, I think I ended up with using sed in props to remove the offending " ".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can you share the props or SEDCMD you are using right now?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure, it seems it was only needed for a particular eventhub, and there I am running:
SEDCMD-remove_quot_infront= s/^\"{/{/g
SEDCMD-remove_quot_behind = s/}\"$/}/g
SEDCMD-remove_slash = s/\\"/"/g
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yea, smae same but different.
yesterday i applied this and it started working too.
