Hi Friends.
I'm using Splunk cloud 9.0. I have installed "Splunk add-on for Microsoft Cloud services" add-on in Heavy forwarder. I want to get data from Azure Event hub.
I have created Azure app account. I have configured input details. but I'm not getting data to splunk.
I'm getting below error message:
2022-12-26 10:26:32,874 level=WARNING pid=12124 tid=Thread-2 logger=azure.eventhub._eventprocessor.event_processor pos=event_processor.py:_load_balancing:286 | EventProcessor instance '35e1711c-18e6-480f-a203-ee6ec4070fc2' of eventhub 'eh-spyglass-metrics-aks-whsdapedge-eastus2-stg' consumer group 'splunk'. An error occurred while load-balancing and claiming ownership. The exception is AuthenticationError("Management authentication failed. Status code: 401, Description: 'Attempted to perform an unauthorized operation.'\nManagement authentication failed. Status code: 401, Description: 'Attempted to perform an unauthorized operation.'"). Retrying after 11.293821480572925 seconds
I have already raised ticket to add my heavy forwarder server IP to add in the whitelist of Azure event hub.
Could you please assist on this. How to receive data from Azure event hub to splunk?
Thanks in advance.
