Getting Data In

Eventhubs - Splunk Add-ON for ms cloud services partitions

zippo706
Explorer

I was using the MS Azure add-on for splunk.  Trying to switch to Splunk Add-on for MS cloud services.   One thing i noticed is that the event hub i was using is appending event hub events into the same splunk event. 

 Ie, instead of 8 events in Event Hub, and 8 events in splunk (which i saw in ms azure add-on for splunk),

I get 2 events of 4 body.records[].service_principal_name.    The # of appended events is related to the # of partitiions, however, this thing doesn't seem to work w/ 1 partition.  Keep getting can not find partition 0 of 0 when the eventhub is 1 partition.  Formatting is TERRIBLE and it takes 30 seconds to render the 1st record in a search since raw so large.

Any ideas what's going on here?   This supposed to be by design?

Labels (1)
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...