All Apps and Add-ons

What is the reason for Splunk_TA_microsoft-cloudservices missing data?

rayar
Contributor

we have integration with EventHub using Splunk_TA_microsoft-cloudservices

we see that events are missing 

what might be the reason  ? 

in case the event reached the EventHub with delay , will the APP pull the data  ?

how much time back the APP is scanning the data  ?

Labels (1)
0 Karma

shivanshu1593
Builder

Needs a lot of more context from your side but generally speaking the add-on makes a checkpoint based off an offset value that is present in the data, which helps it to recognize as to what it pulled the last time and start ingesting the next log to avoid duplication. Which also answers your other question, how far is the add-on scanning the data.

To identify your issue, a lot more context about the integration would be needed but since you are using Splunk_TA_microsoft-cloudservices, I'd recommend opening a support case with Splunk and submitting a diag file of the server where the add-on is hosted and working. They will be able to help you out.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...