Getting Data In

Microsoft Log Analytics Add-On - Optimize Inputs

maxhan6
Loves-to-Learn Lots

Hello @jkat54,

Currently, we are utilizing the Log Analytics TA for ingesting Azure SQL data into Splunk.  Although the data is being ingested, we do come across situations where the data ingestion stops.  In order to fix the issue, we have a manual workaround where we disable and then enable inputs.  Based on the parameters provided ...

[log_analytics://AZURESQL_CONNECT]
resource_group = <resource_group>
workspace_id = <workspace_id>
subscription_id = <subscription_id>
tenant_id = <tenant_id>
application_id = <application_id>
application_key = ********
log_analytics_query = AzureDiagnostics | where ResourceProvider == 'MICROSOFT.SQL' | where ResourceGroup contains 'CONNECT' | where Category == 'SQLSecurityAuditEvents'
start_date = 07/10/2020 09:00:00
event_delay_lag_time = 10
index = <index>
interval = 300
sourcetype = <sourcetype>

Is there a good way to optimize the inputs for consistent data ingestion?  Any advice or suggestions would be appreciated.  Thanks.

Regards,
Max

 

Labels (1)
Tags (1)
0 Karma

k_cummins
New Member

Here is the suggestion for best performance with no issues for your case.

https://splunkbase.splunk.com/app/7130 

 

Give me a like if that solves yours

https://splunkbase.splunk.com/app/7130

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...