Getting Data In

How to send data to Splunk from Azure Event Hub?

pcontreras
Explorer

Hello there!

I've been ingesting data from Azure Storage Explorer via the Splunk Add-On for Microsoft Cloud Services app, however, I now wish to ingest data from an Azure Event Hub. 

I know I can either create an input in the same app or use the Microsoft Azure Add-on for Splunk app.  Is there a way to specify which partition to collect data from?  Furthermore, is there a way to send data to different indexes and sourcetypes from 1 Event Hub?

I'm working on Splunk Cloud, so I currently don't have access to config files.

Thanks in advance!

FrankVl
Ultra Champion

if you're familiar with Azure Logic Apps, you could consider using those to get events from the Event Hub and push them to a Splunk HEC input. The logic app can then also contain some logic to assign different index/sourcetype etc. to the data (as part of the HEC metadata fields).

I just noticed someone also built a Splunk App around that approach: https://splunkbase.splunk.com/app/6223

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...