Getting Data In

Splunk Add-on for Microsoft Cloud Services Post Upgrade Seeing Some Issues

anandhalagaras1
Contributor

Hi Team,

We have 2 Heavy Forwarder servers in our environment (A & B) and in both the HF servers we have installed the Add-on "Splunk Add-on for Microsoft Cloud Services" and they were running with version 4.3.3

We have configured the inputs (totally 90+ inputs) which is fetching the data from Azure Storage Table and Blob and it was enabled (active) state in (A) HF server whereas in (B) server we have done all the configurations similar like (A) server but we have disabled the inputs. So logs would be getting ingested from this add-on only from (A) server.


So recently we have upgraded our Splunk Add-on for Microsoft Cloud Services from 4.3.3 to 5.1.0 in our HF server (B) server which is in disabled state.

So post upgrade in (B) server I have enabled all the 92 inputs to check the log flow from (B) HF server and later I have done a comparison with (A) and observed the behavior of the log flow in both server and came to know there is a difference.

i.e. When I search the data for last 60 minutes, with host from (B) (Add-on upgraded in this server to latest version) i can see around 221738 events whereas when I searched the data with (A) server for the same last 60 minutes i can see only 110531 events.

I don't know where is the gap and why there is a huge difference in it. So kindly help on how to check and get it fix the same.

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...