Microsoft Log Analytics Add-On - Optimize Inputs

[maxhan6]

Hello @jkat54,

Currently, we are utilizing the Log Analytics TA for ingesting Azure SQL data into Splunk.  Although the data is being ingested, we do come across situations where the data ingestion stops.  In order to fix the issue, we have a manual workaround where we disable and then enable inputs.  Based on the parameters provided ...

[log_analytics://AZURESQL_CONNECT]
resource_group = <resource_group>
workspace_id = <workspace_id>
subscription_id = <subscription_id>
tenant_id = <tenant_id>
application_id = <application_id>
application_key = ********
log_analytics_query = AzureDiagnostics | where ResourceProvider == 'MICROSOFT.SQL' | where ResourceGroup contains 'CONNECT' | where Category == 'SQLSecurityAuditEvents'
start_date = 07/10/2020 09:00:00
event_delay_lag_time = 10
index = <index>
interval = 300
sourcetype = <sourcetype>

Is there a good way to optimize the inputs for consistent data ingestion?  Any advice or suggestions would be appreciated.  Thanks.

Regards,
Max

[k_cummins]

Here is the suggestion for best performance with no issues for your case.

https://splunkbase.splunk.com/app/7130 

Give me a like if that solves yours

https://splunkbase.splunk.com/app/7130