Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Why is Microsoft Azure App for Splunk not showing ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We are running in Splunk Cloud and have configured the "Splunk Add-On for Microsoft Cloud Services" based on the provided configuration documentation.
I am trying to use the Microsoft Azure App for Splunk to view Azure data (which I presumed would be pulled in by the "Splunk Add-On for Microsoft Cloud Services", but the Microsoft Azure App for Splunk shows no data at all.
I have verified the Add-on configuration, but still not seeing any data? Does anyone have this app working and displaying results?
Best regards,
Steve Rogers
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Kindly check the splunkd.log and Add-on's logs to see if any errors you are encountering.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How many inputs have you configured on the add-on?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Kindly check the splunkd.log and Add-on's logs to see if any errors you are encountering.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Vatsal,
Thanks for the response. I don't see any errors in the Splunkd log. I will reach out to Splunk support for assistance.
Best regards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I'm facing the same issue. do you use event hub before the data goes to splunk? at least that's what was written in many documentations that this is necessary.
anyways, the problem results in the use of event hub. since event hub is only giving one sourcetype for all the data that it is processing, something like "xyz_eventhub" so the azure app can't handle this since it is looking for sourcetypes for health report, signins etc.
as far as I understand I have to split all the incoming data in props/transforms according to specific markers, such as category of the event and then regex it to work.
maybe that's the way you have to go too? if there is another way, I'm all ears btw.
cheers,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Anyone get this fixed ? I have the same issues
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi, we are facing same issue - no errors, everything looks clean, all config looks ok and still no logs are being ingested. I wonder if that even hub is really necessary for this add-on to work? I am really looking to pull data via API... and for now without event hub. Anyone has any ideas where do we start digging? Could that be anything at Azure side that we are missing? Maybe permissions or something?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@avoelkany leads on the mscs:azure:eventhub single sourcetype data feed?
Fall Into Learning with New Splunk Education Courses
Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...
How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes
